{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The use of agentic AI frameworks like ARTEX allows nation-state actors to compress the window between reconnaissance and privileged access to under 3 hours; identifying the authentication lead immediately is critical to preventing downstream supply chain data theft." }, "name": "Storm-0940 AI-Accelerated Authentication", "type": "investigation", "labels": [ "hunt", "attack.t1110.003", "attack.t1190", "attack.t1195", "credential access", "exfiltration", "initial access", "persistence" ], "series": { "slug": "ai-driven-large-scale-nation-state-campaign-using-artex-enables-supply-chain-compromise", "index": 1, "title": "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise", "total": 2 }, "related": [ { "hunt": "storm-0940-graph-api-reconnaissance", "reason": "Once an application is confirmed compromised, a second hunt must examine the Microsoft Graph API activity for data theft and further persistence.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A simple spray detection rule fires on volume but lacks the context of 'app-only' authentication transitions. This hunt specifically correlates the high-volume noise of AI agents with the quiet, privileged modifications they make to service principals, which a single rule cannot easily join across audit and sign-in surfaces.", "coverage": [ { "stage": "ai-automated-password-spraying", "steps": [ "infrastructure-scoping", "high-volume-spraying" ], "status": "covered" }, { "stage": "compromised-application-abuse", "steps": [ "app-credential-activity", "triage-automated-activity" ], "status": "covered" }, { "stage": "connectwise-supply-chain-compromise", "reason": "Belongs to another part of the 'AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise' series.", "status": "out_of_scope" }, { "stage": "graph-api-recon-and-persistence", "reason": "Belongs to another part of the 'AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise' series.", "status": "out_of_scope" }, { "stage": "privilege-and-group-modification", "reason": "Belongs to another part of the 'AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise' series.", "status": "out_of_scope" }, { "stage": "mailbox-and-file-exfiltration", "reason": "Belongs to another part of the 'AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "AI-Automated Password Spraying", "slug": "ai-automated-password-spraying", "tactic": "credential-access", "techniques": [ "T1110.003" ], "observables": [ "IP address 144.172.64.99", "2,900 authentication attempts per minute", "151,000+ failed logon events", "98% lockout responses", "Targeting Microsoft 365 and Exchange Online", "Peak activity on October 11, 2026" ] }, { "name": "ConnectWise Supply Chain Compromise", "slug": "connectwise-supply-chain-compromise", "tactic": "initial-access", "techniques": [ "T1195" ], "observables": [ "ConnectWise Cloud Backup application", "Multi-tenant application compromise", "Stolen application credentials/identities" ] }, { "name": "Compromised Application Authentication", "slug": "compromised-application-abuse", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "Service principal sign-ins from 144.172.64.x IP range", "ARTEX framework (Next.js frontend)", "Use of stolen app credentials to bypass interactive sign-in", "Authentication to 2,250+ tenants" ] }, { "name": "Microsoft Graph Reconnaissance and Persistence", "slug": "graph-api-recon-and-persistence", "tactic": "persistence", "techniques": [ "T1087", "T1098" ], "observables": [ "Microsoft Graph API calls", "Listing directories, permissions, and approvals", "Modification of OAuth application credentials", "Adding new application owners or service principals", "Modifying app-role assignments" ] }, { "name": "Privilege and Group Modification", "slug": "privilege-and-group-modification", "tactic": "persistence", "techniques": [ "T1098" ], "observables": [ "Changes to privileged roles", "Modification of group memberships", "Conditional Access policy changes", "Identity-related directory operations" ] }, { "name": "Mailbox and File Exfiltration", "slug": "mailbox-and-file-exfiltration", "tactic": "exfiltration", "techniques": [ "T1041" ], "observables": [ "Unusual mail or file access and downloads", "Creation of inbox or transport rules", "Delegated mailbox permission changes", "Forwarding rule creation" ] } ], "summary": "Storm-0940 used the ARTEX agentic AI framework to automate large-scale password spraying and a supply chain compromise of the ConnectWise multi-tenant application. The actor abused stolen application credentials to perform high-speed reconnaissance via Microsoft Graph, modify application credentials for persistence, and exfiltrate mailbox data from Microsoft 365 environments." }, "severity": "high", "rationale": "Focus on external identity planes (Entra ID, Microsoft 365). The reporting devices for these authentications are typically Domain Controllers or Identity Proxies. Use the 'infrastructure-scoping' results to narrow the spray search.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary is using agentic AI to automate high-volume password spraying and service principal authentication from a known infrastructure range to bypass interactive sign-ins.", "parameters": { "storm_ips": { "from": { "ref": "msrc-blog-storm-0940", "kind": "article", "observed": "2026-10-21" }, "type": "list[ip]", "default": [ "144.172.64.99" ], "description": "Known Storm-0940 infrastructure IPs reported in the campaign." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Hostnames identified in the scoping step to narrow the focus." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "name": "Storm-0940 uses ARTEX agentic AI ConnectWise supply chain compromise" } ], "blind_spots": [ { "id": "limited-entra-retention", "risk": "Standard Entra ID sign-in logs are often limited to 30 days; activity from early September might be unavailable if the hunt is delayed.", "stage": "ai-automated-password-spraying", "question": "whether activity occurred more than 30 days ago", "requires": "Extended Entra ID logging" }, { "id": "proxy-rotation", "risk": "If the AI framework uses the reported IP for high-volume spraying but switches to residential proxies for the actual application abuse, the correlation in the parallel step will fail.", "stage": "compromised-application-abuse", "question": "whether the adversary rotated to residential proxies for successful logons", "requires": "Cross-tenant IP enrichment" } ] }, "name": "Storm-0940 AI-Accelerated Authentication", "description": "This hunt identifies automated authentication campaigns linked to Storm-0940 and the ARTEX AI framework. It focuses on the machine-speed transition from high-volume password spraying to the abuse of compromised service principal credentials. By correlating authentication volume from identity surfaces with application credential changes in cloud audit logs, the hunt identifies tenants where AI-driven agents have achieved initial access and established persistence." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "ai-driven-large-scale-nation-state-campaign-using-artex-enables-supply-chain-compromise", "index": 1, "title": "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise", "total": 2 }, "coverage": [ { "stage": "ai-automated-password-spraying", "steps": [ "infrastructure-scoping", "high-volume-spraying" ], "status": "covered" }, { "stage": "compromised-application-abuse", "steps": [ "app-credential-activity", "triage-automated-activity" ], "status": "covered" }, { "stage": "connectwise-supply-chain-compromise", "reason": "Belongs to another part of the 'AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise' series.", "status": "out_of_scope" }, { "stage": "graph-api-recon-and-persistence", "reason": "Belongs to another part of the 'AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise' series.", "status": "out_of_scope" }, { "stage": "privilege-and-group-modification", "reason": "Belongs to another part of the 'AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise' series.", "status": "out_of_scope" }, { "stage": "mailbox-and-file-exfiltration", "reason": "Belongs to another part of the 'AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise' series.", "status": "out_of_scope" } ], "rationale": "An adversary is using agentic AI to automate high-volume password spraying and service principal authentication from a known infrastructure range to bypass interactive sign-ins.", "blind_spots": [ { "id": "limited-entra-retention", "risk": "Standard Entra ID sign-in logs are often limited to 30 days; activity from early September might be unavailable if the hunt is delayed.", "stage": "ai-automated-password-spraying", "question": "whether activity occurred more than 30 days ago", "requires": "Extended Entra ID logging" }, { "id": "proxy-rotation", "risk": "If the AI framework uses the reported IP for high-volume spraying but switches to residential proxies for the actual application abuse, the correlation in the parallel step will fail.", "stage": "compromised-application-abuse", "question": "whether the adversary rotated to residential proxies for successful logons", "requires": "Cross-tenant IP enrichment" } ], "scoping_notes": "Focus on external identity planes (Entra ID, Microsoft 365). The reporting devices for these authentications are typically Domain Controllers or Identity Proxies. Use the 'infrastructure-scoping' results to narrow the spray search.", "beyond_detection": "A simple spray detection rule fires on volume but lacks the context of 'app-only' authentication transitions. This hunt specifically correlates the high-volume noise of AI agents with the quiet, privileged modifications they make to service principals, which a single rule cannot easily join across audit and sign-in surfaces." } }, { "id": "infrastructure-scoping", "type": "query", "label": "Identify affected reporting hosts", "config": { "dsl": "sqlite", "role": "scoping", "source": "identity", "content": "SELECT DISTINCT device_hostname FROM hb_auth_signin WHERE instr(',' || '{{storm_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_auth_signin", "description": "Find the reporting devices (domain controllers or gateways) that have logged activity from the known Storm-0940 IP range.", "expected_signal": "A list of hostnames. These are the machines that processed the malicious authentication traffic and should be used to populate scope_hosts." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify affected reporting hosts", "reads": [ "device_hostname", "src_endpoint_ip", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT DISTINCT device_hostname FROM hb_auth_signin WHERE instr(',' || '{{storm_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A list of hostnames. These are the machines that processed the malicious authentication traffic and should be used to populate scope_hosts.", "verified": "dry-run", "verified_at": "2026-10-22" } }, { "id": "high-volume-spraying", "type": "query", "label": "Detect machine-speed password spraying", "config": { "dsl": "sqlite", "role": "baseline", "source": "identity", "content": "SELECT src_endpoint_ip, COUNT(*) as attempts, COUNT(DISTINCT actor_user_name) as unique_users, SUM(CASE WHEN status_id = 2 THEN 1 ELSE 0 END) as failures, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_auth_signin WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip HAVING attempts > 500 AND (failures * 1.0 / attempts) > 0.95 ORDER BY attempts DESC", "surface": "hb_auth_signin", "description": "Identify IPs exceeding normal human login rates, focusing on those interacting with the scoped identity infrastructure.", "expected_signal": "Source IPs with thousands of failures. Storm-0940 activity peaked at 2,900 attempts per minute." }, "parents": [ { "id": "infrastructure-scoping" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Detect machine-speed password spraying", "reads": [ "src_endpoint_ip", "actor_user_name", "status_id", "time", "device_hostname" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT src_endpoint_ip, COUNT(*) as attempts, COUNT(DISTINCT actor_user_name) as unique_users, SUM(CASE WHEN status_id = 2 THEN 1 ELSE 0 END) as failures, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_auth_signin WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip HAVING attempts > 500 AND (failures * 1.0 / attempts) > 0.95 ORDER BY attempts DESC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Source IPs with thousands of failures. Storm-0940 activity peaked at 2,900 attempts per minute.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "src_endpoint_ip" ], "rare_below": 2 }, "verified_at": "2026-10-22" } }, { "id": "app-credential-activity", "type": "query", "label": "Application and role modifications", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT time, actor_user_name, api_operation, target_resource_types, resource_name, src_endpoint_ip, status_detail FROM hb_cloud_api_activity WHERE provider = 'azure_ad' AND (LOWER(api_operation) LIKE '%credential%' OR LOWER(api_operation) LIKE '%role%' OR LOWER(api_operation) LIKE '%consent%') AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY time DESC", "surface": "hb_cloud_api_activity", "description": "Identify changes to service principal credentials or role assignments in Entra ID that often follow a successful automated spray.", "expected_signal": "Audit logs showing credential additions or privilege escalations, particularly if the src_endpoint_ip matches one from the spray results." }, "parents": [ { "id": "infrastructure-scoping" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Application and role modifications", "reads": [ "time", "actor_user_name", "api_operation", "target_resource_types", "resource_name", "src_endpoint_ip", "status_detail" ], "source": "hb_cloud_api_activity", "target": "endpoint", "content": "SELECT time, actor_user_name, api_operation, target_resource_types, resource_name, src_endpoint_ip, status_detail FROM hb_cloud_api_activity WHERE provider = 'azure_ad' AND (LOWER(api_operation) LIKE '%credential%' OR LOWER(api_operation) LIKE '%role%' OR LOWER(api_operation) LIKE '%consent%') AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY time DESC", "silence": "not_evidence_of_absence", "expected": "Audit logs showing credential additions or privilege escalations, particularly if the src_endpoint_ip matches one from the spray results.", "verified": "dry-run", "verified_at": "2026-10-22" } }, { "id": "triage-automated-activity", "type": "analytic", "label": "Weigh automated intrusion evidence", "config": { "cite": "required", "tools": [ "endpoint", "identity" ], "context": [ "infrastructure-scoping", "high-volume-spraying", "app-credential-activity" ], "objective": "Characterize the authentication attempts and correlate them with any successful sign-ins or directory changes. Determine if the speed and pattern match an agentic AI framework (ARTEX) and if any applications were successfully compromised.", "description": "Determine if the spray activity and subsequent audit events indicate a successful breach by the Storm-0940 agentic framework.", "max_iterations": 6, "expected_signal": "A detailed verdict linking IPs, spraying volume, and specific service principal modifications.", "success_criteria": "A per-host or per-tenant verdict (malicious, suspicious, benign) with citations for the specific spray IPs and affected service principals." }, "parents": [ { "id": "high-volume-spraying", "kind": "merge" }, { "id": "app-credential-activity", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on intrusion probability", "config": { "fuzzy": true, "judge": "hunter", "question": "The triage verdict is malicious for any successful application authentication or credential modification from a suspect IP.", "condition": "The triage verdict is malicious for any successful application authentication or credential modification from a suspect IP.", "blind_spot": "limited-entra-retention", "confidence": "high", "description": "Branch based on whether the agent confirmed malicious application abuse.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-automated-activity" } ] }, { "id": "revoke-app-credentials", "type": "action", "label": "Revoke compromised app credentials", "config": { "target": "identity", "description": "Immediately rotate or revoke secrets for the compromised service principal to stop the AI agents.", "instructions": "Revoke all certificates and secrets for the service principals identified by the triage agent. Rotate credentials for any affected administrative accounts.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-triage-task", "type": "task", "label": "Analyst verification and scoping", "config": { "assignee": "analyst", "description": "Verify the agent's findings and prepare the scope for the follow-on Graph API reconnaissance hunt.", "instructions": "Review the identified successful logons and directory changes. Confirm if they match the ConnectWise advisory context. Record the object IDs of compromised apps for use in the 'Storm-0940 Graph API' hunt." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "revoke-app-credentials" } ] }, { "id": "close-out", "type": "task", "label": "Close out and monitor", "config": { "assignee": "analyst", "description": "Document the negative result and maintain monitoring for the reported IPs.", "instructions": "Log the findings. If spraying was detected but no successful logons occurred, ensure the accounts are monitored for persistent lockouts." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" } ] } ] }