Storm-0940 Deploys AI Agents in Rapid ConnectWise Supply Chain Breach

China-state-aligned threat actor Storm-0940 executed a massive supply chain attack by leveraging ARTEX, an open-source agentic AI penetration testing framework, to breach ConnectWise systems. Microsoft disclosed that the group used stolen credentials from multi-tenant applications to authenticate directly into customer environments without interactive user sign-ins. The operation targeted more than 2,250 Microsoft 365 tenants, with some instances reaching privileged access levels within three hours of initial targeting.

The campaign, active since 2021, targeted industries including aerospace, defense, semiconductors, and government think tanks. Microsoft confirmed that the intrusion did not stem from a vulnerability in its own services. Instead, the attackers exploited compromised ConnectWise application identities. Storm-0940, which has no known industry aliases, utilized the AI framework to accelerate reconnaissance, password spraying, and OAuth application abuse, allowing agents to operate continuously with minimal human intervention.

The attack timeline reveals a high-velocity operation. On October 11, password spraying peaked at 2,900 attempts per minute, resulting in over 111,000 failed logons for the day. While nearly 98% of these attempts were locked out, the AI agents successfully used four application credentials to sign into customer tenants from the same IP range. In one burst, more than 200 sign-ins occurred in under four minutes. The systematic, sorted-order sweep of tenants suggests the use of scripted target lists.

Within compromised tenants, the agents performed directory operations, reconnaissance, and modifications to identities and privileged roles. On October 15, security firm Huntress observed an application in one tenant assigning itself the top administrator role, triggering a Microsoft Defender alert. The attackers also planted new secrets configured to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants. The following day, almost 1,000 Entra tenants showed sign-in activity from the attacking IP, with more than 300 successful logins.

The use of ARTEX distinguishes this campaign from traditional attacks, as the framework can utilize various AI models. Public reports this month linked similar AI-driven breaches to South Korean financial institutions, with CrowdStrike suggesting the suspect in those cases was likely China-based and used ARTEX with Anthropic’s Claude Code. In response, ARTEX’s developer, known as “Autumn-27,” announced on GitHub that the project would cease updates and transition to closed-source status.

ConnectWise responded by suspending Cloud Backup, SaaS Security, and Cloud Management services as a precaution. The company has initiated a phased restoration process, expecting recovery to take several days, and currently shows no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review recent activity logs to assess potential exposure.

The incident highlights the growing efficiency of AI-assisted threat operations, which compress the detection and response window for defenders. As autonomous agents become more prevalent in cyberattacks, organizations are being urged to monitor for automated, high-volume sign-in patterns and verify the integrity of third-party application credentials.