ConnectWise Supply Chain Compromise: Storm-0940 Used AI to Attack 2,250 M365 Tenants

Microsoft has published a technical report linking the ConnectWise Cloud Backup supply chain compromise to the China-linked threat group Storm-0940. The report indicates that the group utilized an artificial intelligence-driven penetration testing framework to accelerate their operations against Microsoft 365 environments.

What happened

Microsoft’s report states that Storm-0940 is responsible for the ConnectWise supply chain compromise involving a multi-tenant application. The group has been active since 2021 and historically relied on password spraying and OAuth application abuse to enter Microsoft 365 environments. According to Security Affairs, the group recently adopted ARTEX, an open-source AI-driven penetration testing framework, to scale their attacks. This tool allowed the actors to operate at machine speed against hundreds of organizations in sectors including aerospace, defense, energy, and financial services.

Before obtaining the ConnectWise credentials, Storm-0940 launched a password spraying campaign between October 10 and 14. Microsoft recorded more than 151,000 failed login attempts against 327 accounts at eight organizations from the IP address 144.172.64[.]99. Activity peaked on October 11 with 2,900 failed attempts per minute, though none of these initial attempts succeeded.

The tactics shifted on October 15, one day after the ConnectWise breach became public. Storm-0940 obtained credentials for several ConnectWise cloud application accounts and used them to log directly into customer Microsoft 365 environments. The AI agents stopped trying passwords and instead abused the compromised application access. Microsoft notes that this use of ARTEX accelerated the speed of compromised application abuse to authenticate to customer environments.

Why it matters

The integration of AI tools like ARTEX significantly reduced the time required to achieve privileged access. Microsoft assesses that in multiple instances, the time from initial targeting to privileged access was less than three hours. This rapid escalation highlights the increased risk posed by supply chain compromises when combined with automated exploitation frameworks. The group targeted 2,250 Microsoft 365 tenants, demonstrating the broad reach possible when a central service provider is compromised.

What to watch

• Monitor for rapid authentication spikes from known service provider IPs.
• Review OAuth application permissions for unusual activity or new grants.
• Check for successful logins following periods of failed password attempts.
• Validate the integrity of cloud backup application credentials regularly.

Signals worth monitoring

Security teams should prioritize monitoring for rapid authentication sequences that follow periods of failed login attempts. Analysts usually look for successful logins from applications that have broad permissions, especially if those logins occur shortly after a known supply chain incident. Check whether privileged access is granted quickly after initial compromise indicators appear. Teams often review OAuth consent logs for unusual application behavior or new permission grants. Containment moves typically involve revoking suspicious application tokens and resetting credentials for affected service accounts immediately.

Background: Penetration testing

Small businesses should prioritize automated vulnerability scanning for infrastructure and manual code review for custom applications. Delegate external network testing to certified professionals while handling internal configuration checks internally. Focus on high-impact areas like authentication and data exposure to maximize security value within limited budgets.

Read the full guide: Penetration Testing for Small Businesses: Low-Cost Security Validation

What to do and how to stay safe: Microsoft

• Audit all OAuth applications connected to your Microsoft 365 tenant for unnecessary permissions.
• Implement conditional access policies that require multi-factor authentication for all administrative accounts.
• Monitor for anomalous login patterns, such as high volumes of failed attempts followed by success.
• Review and rotate credentials for any third-party cloud backup or management tools regularly.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which threat group is responsible for the ConnectWise breach?

Microsoft identifies Storm-0940, a China state-aligned group, as the actor behind the compromise.

What tool did the group use to accelerate attacks?

The group used ARTEX, an open-source AI-driven penetration testing framework.

How many Microsoft 365 tenants were targeted?

The attacks targeted 2,250 Microsoft 365 tenants across various industries.