AI agents boost supply chain attack against thousands of tenants

A massive ConnectWise supply chain attack used AI agents to attempt sign-ins at more than 2,250 Microsoft 365 tenants, with some attackers reaching privileged access in under three hours. This attack was carried out by Storm-0940, a China-state aligned actor, who used ARTEX, an open-source agentic AI penetration testing framework. After gaining unauthorized access to the multi-tenant application, the attackers used stolen ConnectWise app credentials to try and log in, with no interactive user sign-in needed. The AI agents sped up scanning, reconnaissance, password spraying, and OAuth application abuse, working around the clock with little human interaction.

The attack involved automated password guessing, or password spraying, which targeted 327 accounts across eight organizations with more than 151,000 failed logons and no successes. It’s unclear how the ConnectWise credentials were stolen or how many tenants were actually compromised. Storm-0940 has been active since 2021 and is a “China-state aligned actor” with “no known industry aliases.” The industries targeted this time include aerospace and defense, semiconductor, government, and think tanks, with 14 listed in total.

The activity “did not result from a compromise of or a vulnerability” in Microsoft’s systems, products, or services. At its peak on Oct. 11, the password spray engaged in 2,900 attempts, all failures, per minute, at more than 111,000 for that day, with 48 accounts logging more than 1,000 failures each. Almost 98% of this activity was locked out. However, with control of the identities of multiple ConnectWise cloud apps, the attacking AI agents signed in to customer tenants from the same IP range using those apps’ credentials, with more than 200 sign-ins in under four minutes using four application credentials.

Operations taken within some tenants include Graph and directory operations, reconnaissance, app credential changes, plus changes to identities, groups, and privileged roles. In one tenant on Oct. 15, Huntress, a security firm, saw an app add itself to the top administrator role, the behavior behind the Microsoft Defender alert “Application self-assigned Global Administrator role.” Actions included planting new secrets set to expire in 2028. It confirmed unauthorized sign-ins for 162 tenants by Oct. 16 and, a day later, almost 1,000 Entra tenants with sign-in activity from the attacking IP, with more than 300 succeeding. The attack’s sweep through tenants in sorted order, a few seconds apart, indicated “a script working from a target list.”