A China-linked threat actor that Microsoft tracks as Storm-0940 used an agentic AI penetration-testing framework to accelerate a supply chain attack involving ConnectWise Cloud Backup.
The attackers used compromised application credentials associated with the service to attempt to access the Microsoft 365 environments of more than 2,250 downstream customer tenants. In multiple instances, the attackers obtained privileged access to an organization’s cloud infrastructure in less than three hours after initial targeting, Microsoft said in an analysis published this week.
Agentic AI Accelerates Storm-0940 Attack
The activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and scaling their operations exponentially, Microsoft researchers wrote. “While the majority of the targeting wasn’t successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time,” they said.
ConnectWise provides software and IT management technology that managed service providers use to deliver a broad range of services to their customers, including backup and recovery for Microsoft 365 data. Delivering these services requires the company to have authorized application access to customer Microsoft 365 environments to back up and restore data.
On Oct. 16, ConnectWise disclosed unauthorized access to application identities associated with its Cloud Backup product. The company subsequently published additional details and containment guidance but has not publicly explained how the attackers initially gained control of the application identities.
Microsoft described the incident as part of a broader Storm-0940 campaign that began as early as September and targeted hundreds of organizations worldwide across several industries including manufacturing, aerospace, chemicals, energy, defense, and financial services. The threat actor has been using an AI penetration-testing framework called ARTEX to automate and accelerate its operations.
“In multiple affected environments, Microsoft observed AI-accelerated follow-on activity through Microsoft Graph, including reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access,” Microsoft said.
In the ConnectWise incident, Storm-0940 used ARTEX to accelerate reconnaissance and scanning, password spraying, and OAuth application abuse. The threat actor used ARTEX to attempt sign-ins to more than 2,250 tenants, generating as many as 2,900 sign-in attempts per minute. That pace left defenders with little time to detect and respond to the activity, Microsoft noted.
“Storm-0940’s activity illustrates how a threat actor with a broad target set can use an agentic AI tool and privileged authentication material to quickly attempt to compromise many organizations,” the company said.
ConnectWise Service Disrupted
ConnectWise suspended its Cloud Backup service and also took its SaaS Security and Cloud Management services offline following the incident. In an Oct. 22 update, the company noted it was continuing work on restoring disrupted services and urged customers to keep affected ConnectWise application connections offline till further notice.
“Investigation and monitoring continue alongside restoration. Existing backup archives remain encrypted, isolated and preserved, with no indication of compromise,” the company said. ConnectWise called on customers to review their individual Microsoft 365 environments using the company’s technical investigation and remediation guide and related information.
Microsoft meanwhile highlighted its own mitigation and protection guidance, which included recommendations like reviewing every Microsoft 365 tenant that might have been tied to ConnectWise and to preserve logs and other forensic evidence before making any changes.
Ross Filipek, CISO at Corsica Technologies, says that before reconnecting with ConnectWise, affected organizations should have a clear understanding of what might have happened inside their environment. He pointed to Microsoft’s discovery of application credential changes that could give attackers a way back in to compromised environments. Organizations are going to need to investigate their Microsoft 365 environments are safe before they reconnect, he says.
“Keep affected connections disabled in line with vendor guidance. Investigate unauthorized changes that could leave another way in. Preserve evidence without delaying containment,” Filipek tells Dark Reading. “There’s also an immediate business question: Are backups still running? Assign someone on each side to check coverage during the interruption. A restored connection needs verification that backup jobs are completing and recovery works.”
Planning for Recovery After Storm-0940
Going forward, organizations need to have a recovery plan that takes into account the potential of their losing access to a service that they normally would depend on for recovery, Filipek adds. Incident responders should know which applications connect to the organization’s Microsoft 365 tenant and how to quickly sever those connections when necessary, and exercise that scenario with their service provider.
“Establish who checks backup coverage during containment and who decides whether the business can tolerate the interruption. Leaving those responsibilities implied is how both sides end up assuming the other has checked,” he says.
Jon Baker, vice president of threat informed defense at AttackIQ, wants affected organizations to preserve sign-in and audit records and to investigate application sign-ins, Microsoft Graph activity, new credentials, privilege changes and unusual data access. “Remove confirmed unauthorized access and verify vendor and tenant remediation separately,” he advises. “After containment, controlled validation can test whether comparable application behavior can still reach sensitive resources or establish another foothold.”
