China‑Aligned Threat Actor Leverages Agentic AI (Artex) to Automate Password Spraying and OAuth Abuse in ConnectWise Supply Chain

What happened

A China‑aligned nation‑state group (Storm‑0940) used the Artex LLM‑driven framework to conduct automated reconnaissance, password‑spraying, and OAuth‑application abuse against ConnectWise’s cloud‑backup platform, generating >2,250 tenant sign‑in attempts at ~3,000 per minute. ConnectWise detected the activity, suspended services, and began an investigation; no successful breach has been confirmed.

Why it matters for trust and compliance

• The campaign illustrates why continuous monitoring of third‑party access and automated credential‑spray detection are core control objectives for a trustworthy supply‑chain posture, providing defensible evidence for audit readiness.
• Map third‑party risk controls to continuous monitoring objectives and collect real‑time evidence.
• Validate OAuth‑grant governance and enforce MFA to reduce credential‑spray exposure.

Who is affected

Recommended actions

1. Align your vendor‑oversight controls with the supply‑chain risk objective and enable continuous monitoring.
2. Deploy automated password‑spray detection, enforce MFA, and audit OAuth application permissions.