AI-Powered APT Exploits OAuth Misconfigurations to Compromise Hundreds of Entra Tenants
Storm-0940 weaponized the open-source AI penetration testing tool Artex to conduct machine-speed password spraying and OAuth application abuse against ConnectWise customers, overwhelming defenses that were designed for human-paced attacks. The attackers modified application credentials within compromised Entra tenants to establish persistent backdoors, meaning that even organizations that attempted remediation remained exposed. This incident highlights how AI-assisted offensive tooling dramatically compresses the attack timeline, leaving defenders little window to detect and respond before persistence is established. The abuse of OAuth applications as a persistence mechanism underscores the critical importance of hardening identity configurations and continuously auditing registered applications and their permissions.
Tactical Insight
Immediate actions
- Audit all OAuth application registrations in Microsoft Entra for unexpected credential modifications or overly permissive scopes and revoke any unauthorized entries immediately.
- Enable and enforce phishing-resistant MFA (e.g., FIDO2) across all Entra accounts to neutralize password-spraying attacks regardless of volume or speed.
- Block or alert on anomalous authentication patterns such as high-volume sign-in attempts from unfamiliar IP ranges using Entra Identity Protection risk policies.
Configuration hardening
- Restrict which users and roles can register OAuth applications or modify application credentials in Entra, applying the principle of least privilege to identity platform administration.
- Implement Conditional Access policies that deny authentication from non-compliant or unrecognized devices and flag impossible-travel or velocity-based anomalies.
- Regularly review and enforce ConnectWise platform hardening guides, disabling unused features and locking down remote management endpoints exposed to the internet.
Detection measures
- Deploy continuous monitoring and alerting on Entra audit logs for application credential additions, OAuth consent grants, and bulk sign-in failures to detect AI-paced attacks early.
- Integrate threat intelligence feeds covering known APT infrastructure so AI-assisted reconnaissance traffic from attributed sources triggers automated blocking and incident escalation.