Microsoft says Storm-0940 used ARTEX agent to hit 2,250 tenants via ConnectWise

An unattended agent on the other side of a breach can try 2,900 sign-ins per minute, and the alert queue on the defender side has not changed. A team using ConnectWise cloud backup needs to look at its Microsoft 365 service principal sign-ins today.

Microsoft Threat Intelligence attributes the ConnectWise cloud backup supply chain compromise disclosed on 16 October to Storm-0940, a China state-aligned actor active since 2021. The actor used ARTEX, an open-source penetration testing framework that runs an autonomous attack through multiple large-language-model-driven agents, to reach downstream customers at machine speed. TechCrunch carried the story.

What the agent did

The attacker stole application credentials from ConnectWise cloud backup. Those credentials give the backup service access into each customer's Microsoft 365 tenant, so the stolen keys gave the attacker a signed-in path into every one of them, without any user interaction.

Microsoft says Storm-0940 then used ARTEX to try to sign in to more than 2,250 tenants at 2,900 attempts per minute. A separate password-spray run between 10 and 14 October against 327 accounts at eight organisations produced more than 151,000 failed logons and peaked at 2,900 failures per minute. In some tenants the agents went past authentication into Microsoft Graph, where they read directory objects, added application credentials, and changed privileged role assignments. Microsoft says these changes can leave a working path back in even after the ConnectWise connection is cut.

What ARTEX is

ARTEX is a public multi-agent system written in Go with a Next.js frontend. It runs an autonomous penetration test from reconnaissance to data exfiltration with little human input, and its agents collect the discovered assets and vulnerabilities into a shared graph. Microsoft says the framework can be pointed at any model and has been used in a separate recent compromise of South Korean financial systems.

What to do now

Microsoft's immediate guidance to defenders is to keep ConnectWise application connections disabled until ConnectWise publishes restoration instructions, and to search every Microsoft 365 tenant where any of the affected applications is or was installed. Search by application ID rather than display name. Preserve the Microsoft Entra sign-in and audit records, Microsoft Purview audit records, and any Microsoft Graph telemetry before making changes, so there is evidence left to work from. Review service principal sign-ins back to 1 October, review Microsoft Entra audit records for new application credentials, service principals, owners, consent grants and privileged role assignments, and revoke anything that was not expected.

The common point behind the whole incident is that an agent compressed the time between initial access and privileged persistence to under three hours in several tenants. A detection and response plan built around human-paced attackers has to be rebuilt around attackers running at machine speed.

Source

Microsoft Security Blog, "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise", reported on TechCrunch by Zack Whittaker.