AI agents accelerate ConnectWise supply-chain attack
A China-aligned group uses agentic automation and stolen ConnectWise credentials while targeting Microsoft 365 tenants.
What happened
A China-aligned group obtained application credentials associated with ConnectWise Cloud Backup and used them to access connected Microsoft 365 environments. Microsoft attributed the activity to Storm-0940 and said the group used the ARTEX agentic framework while targeting approximately 2,250 tenants.
Why it matters
Application identities can hold broad permissions without requiring a user login. Once compromised, they can provide a route into many customer environments. Agentic automation allowed the attackers to operate at thousands of attempted sign-ins per minute, reducing the time available for defenders to respond.
The bigger picture
AI is accelerating established intrusion methods rather than replacing them. The number of tenants targeted should not be confused with the number successfully compromised, which remains unclear. The campaign strengthens the case for short-lived credentials, narrow application permissions and automated monitoring.