Storm-0940 Launches Autonomous AI Agents in Supply Chain Intrusions

A China-aligned cyber group, identified as Storm-0940, has deployed autonomous artificial intelligence agents to execute a rapid and widespread supply chain attack targeting ConnectWise, according to a report from Microsoft's Security blog. The operation involved the use of an open-source framework called ARTEX, which allows large language models to operate as autonomous penetration testing agents. This technology facilitated scanning, reconnaissance, and password spraying against more than 2,250 Microsoft 365 tenants.

The timeline of these events highlights the speed at which such automated threats can operate. On October 11, automated password guessing, known as password spraying, reached a peak of 2,900 attempts per minute. Although these specific attempts were unsuccessful, they were followed by a different tactic. By October 15, security firm Huntress observed unauthorized applications attempting to assign themselves to administrator roles. By October 16, Huntress had confirmed unauthorized sign-ins for 162 tenants, a figure that grew to almost 1,000 Entra tenants the following day. The activity was characterized by a script working from a target list, moving through tenants in sorted order just seconds apart.

The core of the attack involved the theft of ConnectWise app credentials. With these credentials, the AI agents could authenticate as the applications themselves, bypassing the need for interactive user sign-ins. Microsoft's report indicates that some of the group's attacks achieved privileged access in less than three hours after the initial targeting. Operations observed within some tenants included Graph and directory operations, reconnaissance, changes to app credentials, and modifications to identities, groups, and privileged roles.

Microsoft attributes this activity to Storm-0940, a group active since 2021 described as a "China-state aligned actor" with no known industry aliases. The targets of this campaign spanned 14 industries, including aerospace and defense, semiconductor, government, and think tanks. Microsoft clarified that this activity did not result from a compromise of or a vulnerability in its own systems, products, or services.

The use of ARTEX represents a notable shift in attack methodology. Unlike traditional attacks, this framework can operate with little human interaction, working around the clock at a pace that leaves defenders with little time to detect and respond. Microsoft states that the use of such agents sped up scanning and reconnaissance, password spraying, and OAuth application abuse. It is currently uncertain how the ConnectWise credentials were originally stolen or the exact number of tenants that were compromised.

In response to the unauthorized access, ConnectWise suspended several services, including Cloud Backup, SaaS Security, and Cloud Management, as a precaution. The company has begun a phased restoration process, expected to take several days, and reported no indicators to date that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity from this month where logs allow.