Storm-0940 Linked to AI-Assisted ConnectWise Supply-Chain Compromise

Microsoft linked the China-aligned threat group Storm-0940 to a supply-chain compromise targeting ConnectWise Cloud Backup users, according to reporting summarized by SC Media. The attackers reportedly used ARTEX, an autonomous AI penetration-testing framework, to automate attacks against Microsoft 365 tenants, reaching 2,900 sign-in attempts per minute with compromised ConnectWise application credentials. They also reportedly modified OAuth application credentials to establish persistence, potentially preserving access after initial remediation. ConnectWise suspended affected services on October 17 and worked with partners to identify indicators of compromise; the extent of data exfiltration remained under investigation.

Separate research described ARTEX-associated activity against multiple IT and software vendors, targeting application authentication, Okta, Microsoft Entra ID, AWS Cognito, and Microsoft 365 integrations. Sessions lasted up to 30 hours and combined reconnaissance, password spraying, account-recovery abuse, and cross-tenant access attempts, adapting to blocking and rate limits by rotating IP addresses, user agents, and endpoints. Most observed attempts failed, and infrastructure and technique overlaps with Storm-0940 did not establish attribution for all activity. Defenders should prioritize reviewing third-party application access, auditing OAuth credential changes, and checking for persistent access rather than relying solely on initial credential remediation.