AI-Based Attacks,
Cyberwarfare / Nation-State Attacks,
Fraud Management & Cybercrime
Microsoft Ties Storm-0940 to Automated Intrusions Across Hundreds of Targets
In a significant revelation last week, Microsoft identified the ConnectWise supply chain breach as part of an extensive operation orchestrated by a threat actor aligned with China, known as Storm-0940. This particular actor has adeptly leveraged agentic artificial intelligence to execute penetration tests against hundreds of targets globally, according to researchers.
Microsoft elaborated that the attacks were orchestrated using an open-source framework named Artex, which functions as a large language model capable of facilitating offensive security workflows. This includes various stages of attacks, from reconnaissance to data exfiltration. The extensive use of Artex underscores a worrying trend where advanced AI tools are being increasingly weaponized in cyber operations.
Since September, the Storm-0940 group has automated its attacks, successfully compromising multiple targets, including notable breaches at South Korean financial institutions. By utilizing Artex, the hackers gained administrator access to cloud infrastructures in record time, with privilege escalation achieved in less than three hours. This heightened speed and efficiency raise serious concerns about the vulnerability of contemporary digital environments.
During the ConnectWise incident, Microsoft reported that the threat actor utilized Artex to hasten various malicious activities such as scanning, reconnaissance, password spraying, and OAuth application abuse on downstream victims. ConnectWise disclosed the compromise after it noticed unauthorized login attempts concerning its cloud-based backup and restoration tool—an essential service widely used by managed service providers and enterprise IT departments to safeguard data from platforms like Microsoft 365 and Google Workspace.
Following the breach, Storm-0940 escalated their attempts significantly, aiming to sign in to over 2,250 tenants at a staggering rate of 2,900 sign-in attempts per minute. Microsoft’s report indicated that such rapid operations leave security teams with minimal time to detect and respond to breaches before substantial damage is done. The use of OAuth application abuse is a familiar tactic for Storm-0940, but in this instance, the actors utilized Artex to expedite these processes, operating at machine speed.
Storm-0940 has been active since 2021, employing techniques such as password spraying and exploiting vulnerabilities in internet-facing applications to gain initial access. They have historically used compromised accounts to facilitate lateral movement within networks. Recently, the group has added new credentials to existing OAuth applications, securing ongoing access to Microsoft 365 while simultaneously exfiltrating valuable data.
Between October 10 and October 14, Microsoft observed Storm-0940 conducting a cross-tenant password-spraying campaign utilizing Artex, which targeted more than 300 accounts across several organizations. This automated offensive led to over 150,000 failed login attempts, peaking at nearly 3,000 attempts per minute. Remarkably, Microsoft’s telemetry indicated no successful logins during this intense five-day campaign.
However, shortly after these events, reports began surfacing regarding the ConnectWise compromise, suggesting a correlation with the activities of Storm-0940. Specifically, indicators of compromise (IoCs) emerged, with one of the suspicious IP addresses found in the ConnectWise breach directly matching with those previously observed in the Storm-0940 campaign.
On the same day of Microsoft’s announcement, threat intelligence firm Huntress reported that unauthorized access to ConnectWise customers’ Microsoft 365 environments occurred through a stolen API secret from the backup software. This breach granted the threat actor the necessary credentials to authenticate and infiltrate numerous client environments effectively. As a result, AI agents utilized by the hackers continued to operate using the same range of IP addresses to maintain illicit access, taking advantage of the natural trust established by those applications within their respective tenants.
In various environments, these agents did not just stop at authentication; they embarked on reconnaissance, manipulated application credentials, and altered identities, groups, and privileged roles within Microsoft Graph and directory operations. The automation of these activities, augmented by AI, leads to a significant volume of traffic and log data that may trigger alarms. Unfortunately, the rapid pace of these operations often leaves defenders with very little time to respond adequately.
Furthermore, the modifications made by the threat actors can act as backdoors, enabling them to sustain their presence even after the initial compromised application has been patched. Microsoft has warned of several follow-on activities identified through their incident response investigations, highlighting the cascading repercussions that may follow a compromise involving third-party vendors.
This incident serves as a stark reminder of the evolving landscape of cyber threats, where the sophistication and speed of attacks are being magnified through advanced technologies like artificial intelligence. As organizations continue to rely on interconnected systems and the cloud, the need for robust cybersecurity measures and rapid incident response strategies has never been more crucial.