[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fC-hex-FuvTIQ_4Qf_uG_3KK-Z5X9gHladiYicI1xdXc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"922dbcb6-2c61-4771-a0ed-deeee3c3daa9","ai-powered-apt-exploits-oauth-misconfigurations-to-compromise-hundreds-of-entra-tenants","23ce3c19-4074-48db-9a07-8544f461a907","AI-Powered APT Exploits OAuth Misconfigurations to Compromise Hundreds of Entra Tenants","Storm-0940 weaponized the open-source AI penetration testing tool Artex to conduct machine-speed password spraying and OAuth application abuse against ConnectWise customers, overwhelming defenses that were designed for human-paced attacks. The attackers modified application credentials within compromised Entra tenants to establish persistent backdoors, meaning that even organizations that attempted remediation remained exposed. This incident highlights how AI-assisted offensive tooling dramatically compresses the attack timeline, leaving defenders little window to detect and respond before persistence is established. The abuse of OAuth applications as a persistence mechanism underscores the critical importance of hardening identity configurations and continuously auditing registered applications and their permissions.","**Immediate actions:**\n- Audit all OAuth application registrations in Microsoft Entra for unexpected credential modifications or overly permissive scopes and revoke any unauthorized entries immediately.\n- Enable and enforce phishing-resistant MFA (e.g., FIDO2) across all Entra accounts to neutralize password-spraying attacks regardless of volume or speed.\n- Block or alert on anomalous authentication patterns such as high-volume sign-in attempts from unfamiliar IP ranges using Entra Identity Protection risk policies.\n\n**Configuration hardening:**\n- Restrict which users and roles can register OAuth applications or modify application credentials in Entra, applying the principle of least privilege to identity platform administration.\n- Implement Conditional Access policies that deny authentication from non-compliant or unrecognized devices and flag impossible-travel or velocity-based anomalies.\n- Regularly review and enforce ConnectWise platform hardening guides, disabling unused features and locking down remote management endpoints exposed to the internet.\n\n**Detection measures:**\n- Deploy continuous monitoring and alerting on Entra audit logs for application credential additions, OAuth consent grants, and bulk sign-in failures to detect AI-paced attacks early.\n- Integrate threat intelligence feeds covering known APT infrastructure so AI-assisted reconnaissance traffic from attributed sources triggers automated blocking and incident escalation.",[12,13,14,15,16,17,18],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 6: Access Control Management","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1098: Account Manipulation","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"NIST SP 800-53 SI-2: Flaw Remediation":21,"CIS Control 6: Access Control Management":22,"MITRE ATT&CK T1098: Account Manipulation":23,"CIS Control 17: Incident Response Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires incident handling and access control measures commensurate with the risk; the scale of tenant compromise across eight organizations indicates systematic gaps in both areas that NIS2 obligations would compel organizations to address.","Timely patching and hardening of ConnectWise platform configurations would have reduced the attack surface exploited by Storm-0940 before Artex-assisted reconnaissance could identify and leverage it at scale.","Restricting which identities can register or modify OAuth applications, and enforcing MFA, would have limited the attackers' ability to gain footholds and establish persistent backdoors across Entra tenants.","The attackers modified OAuth application credentials to maintain persistent access, which maps directly to this technique and highlights the need for alerting on any application credential changes within identity platforms.","Victims attempted remediation but attackers had already modified application credentials to survive it, demonstrating that incident response procedures must include OAuth application auditing as a mandatory remediation step.","A structured vulnerability management process covering identity platform misconfigurations and OAuth permission sprawl would have surfaced the exploitable conditions in Entra before the APT could abuse them.","Storm-0940 succeeded through password spraying and OAuth abuse; enforcing strong authentication controls and least-privilege application permissions directly addresses the initial access and persistence vectors used in this attack.","published","2026-10-23T12:21:11.763451+00:00","2026-10-23T12:21:11.743+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.securityweek.com\u002Fchina-apt-uses-ai-pentest-tool-artex-in-connectwise-attacks\u002F","china-apt-uses-ai-pentest-tool-artex-in-connectwise-attacks-28839f","China APT Uses AI Pentest Tool Artex in ConnectWise Attacks",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[49,53,57],{"slug":50,"name":51,"problem":52},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":54,"name":55,"problem":56},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":58,"name":59,"problem":60},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]