CRN reports that the China-aligned threat group Storm-0940 utilized agentic artificial intelligence to execute a large-scale supply chain compromise targeting ConnectWise Cloud Backup users.
Microsoft identified that Storm-0940 employed an AI-driven penetration testing framework known as ARTEX to automate attacks against Microsoft 365 tenants. By leveraging compromised ConnectWise application credentials, the threat actors launched 2,900 sign-in attempts per minute, bypassing the need for interactive user authentication. This automation allowed the group to target hundreds of organizations globally with unprecedented speed. While ConnectWise suspended affected services on October 17 to mitigate the breach, experts warn that the use of agentic AI removes the margin for error for managed service providers. The attackers established persistence by modifying OAuth application credentials, potentially leaving backdoors in customer environments even after initial vulnerabilities were addressed. Industry leaders emphasize that the speed of these AI-enhanced attacks necessitates a shift in security fundamentals, as traditional defensive measures are increasingly insufficient against automated, around-the-clock breach attempts. ConnectWise continues to work with partners to identify indicators of compromise, though the full scope of data exfiltration remains under investigation. The incident highlights the growing threat of nation-state actors integrating advanced AI into offensive workflows to scale operations exponentially.
Source: CRN
