China-state-aligned actor Storm-0940 used ARTEX, an open-source agentic AI penetration testing framework, in its large-scale ConnectWise supply chain attack, Microsoft wrote in its Security blog. After unauthorized access to the multi-tenant application, the group attempted sign-ins at more than 2,250 Microsoft 365 tenants, with stolen ConnectWise app credentials that authenticated as the apps with no interactive user sign-in. Some of the group’s attacks reached privileged access less than three hours after initial targeting.

Automated password guessing, or password spraying, also targeted 327 accounts across eight organizations with more than 151,000 failed logons and no successes. The use of ARTEX, “a system of LLM-driven agents that run an autonomous penetration test,” sped up scanning and reconnaissance, password spraying, and OAuth application abuse. The agents can work around the clock “with little needed human interaction,” at a pace that “leaves defenders with little time to detect and respond.” It’s uncertain how the ConnectWise credentials were stolen or how many tenants were actually compromised.

Storm-0940, active since 2021, is a “China-state aligned actor” with “no known industry aliases,” and its name follows the convention for a developing actor. Industries targeted this time include aerospace and defense, semiconductor, government, and think tanks, with 14 listed in total. The activity “did not result from a compromise of or a vulnerability” in Microsoft’s systems, products, or services.

At its peak on Oct. 11, the password spray engaged in 2,900 attempts, all failures, per minute, at more than 111,000 for that day, with 48 accounts logging more than 1,000 failures each.

Source link