China-aligned hackers deploy AI agents in massive ConnectWise supply chain attack
China-aligned hackers deployed AI agents in a massive ConnectWise supply chain attack, attempting sign-ins at over 2,250 Microsoft 365 tenants.
China-state-aligned actor Storm-0940 utilized ARTEX, an open-source agentic AI penetration testing framework, in its large-scale ConnectWise supply chain attack, Microsoft revealed in its Security blog. After gaining unauthorized access to the multi-tenant application, the group attempted sign-ins at more than 2,250 Microsoft 365 tenants using stolen ConnectWise app credentials.
Some of the group's attacks achieved privileged access in less than three hours after initial targeting. The attackers bypassed normal authentication by using the stolen credentials to authenticate directly as the applications without requiring interactive user sign-ins.
AI Acceleration
The hackers employed automated password guessing, or password spraying, targeting 327 accounts across eight organizations with more than 151,000 failed logons and no successes. ARTEX, described as "a system of LLM-driven agents that run an autonomous penetration test," significantly sped up scanning, reconnaissance, and OAuth application abuse.
The agents can work around the clock with little needed human interaction, at a pace that leaves defenders with little time to detect and respond.
Unknown Factors
It remains uncertain how the ConnectWise credentials were stolen or how many tenants were actually compromised in the attack. The incident highlights the growing sophistication of cyber threats leveraging artificial intelligence to bypass traditional security measures.
Related
