When Storm-0940 compromised ConnectWise in October, they gained privileged cloud access faster than most teams can convene an incident call. Microsoft's investigation revealed the Chinese state-aligned group used ARTEX, an AI penetration testing framework, to breach targets in under three hours, sustaining 2,900 sign-in attempts per minute during the ConnectWise attack.
This threat is current and affects sectors like government, aerospace, defense, finance, manufacturing, technology, and energy. Your TPRM program was built for human-speed attacks. Here's what you need to verify today.
What This Checklist Covers
This checklist addresses defensive posture gaps exposed by AI-accelerated supply chain attacks. Each item focuses on detection speed, authentication controls, and vendor access governance, areas where Storm-0940's ARTEX-enabled campaign exploited traditional defenses.
Use this to audit your current controls against threats that compress reconnaissance-to-exfiltration timelines from weeks to hours.
Prerequisites
Before starting this checklist, confirm:
- You have an inventory of all third-party applications with delegated access to Microsoft 365, Google Workspace, or equivalent cloud infrastructure. Without this baseline, you can't assess exposure.
- Your security team can access authentication logs with sub-hour granularity. If you're reviewing sign-in data daily or weekly, you're already behind AI-driven attack timelines.
- You know which vendors hold credentials that grant lateral movement capability. IT management and backup solutions are high-value targets because they're pre-authorized across your environment.
Checklist Items
1. Rate-limit authentication attempts at the application level, not just the user level.
Storm-0940 generated 111,000 failed log-on attempts on October 11 alone. Traditional user-based rate limiting doesn't catch distributed spraying across multiple accounts.
Configure your identity provider to trigger alerts when any single application generates more than 100 failed authentication attempts within a 10-minute window, regardless of which user accounts are targeted.
Good looks like: Your SIEM generates an alert within 15 minutes of anomalous application-level authentication volume, and your runbook includes immediate credential rotation for that application.
2. Implement privileged access time-boxing for third-party applications.
Vendors with standing privileged access create persistent attack surfaces. ARTEX's autonomous agents can exploit these 24/7.
Require third-party applications to request elevated permissions through a just-in-time approval workflow. Grant access for defined maintenance windows only (e.g., 2-hour blocks).
Good looks like: No third-party application holds standing admin privileges. Every elevation is logged with business justification, approved by a human, and auto-expires.
3. Deploy behavioral baselines for vendor application authentication patterns.
The ConnectWise attack blended low-rate spraying with high-volume bursts against selected identities. This pattern is detectable if you know what normal looks like.
Establish 30-day authentication baselines for each vendor application: typical sign-in frequency, source IP diversity, time-of-day patterns, and failure rates.
Good looks like: You receive alerts when a vendor application's authentication behavior deviates from its baseline by more than 2 standard deviations, before the attack succeeds.
4. Enforce geofencing for vendor application access.
Storm-0940 operated from IP addresses that Microsoft tied to previous campaigns. Geographic origin matters.
Restrict vendor application authentication to known, documented IP ranges. If your backup vendor legitimately operates from three data centers, block authentication attempts from everywhere else.
Good looks like: Your conditional access policies include IP allow-lists for each third-party application, reviewed quarterly, with automatic denial and alerting for out-of-range attempts.
5. Require vendors to disclose their use of AI in operational tooling.
ARTEX was released on GitHub as an open-source penetration testing tool. Your vendors may be using similar frameworks for legitimate security testing, or they may be vulnerable to attackers using them.
Add a contractual requirement: vendors must disclose any AI-enabled tools used for security testing, vulnerability scanning, or access to your environment.
Good looks like: Your vendor contracts include a disclosure obligation for AI tooling, with 30-day notification requirements for new tool adoption and evidence of responsible use policies.
6. Audit vendor sub-processor relationships for security tooling providers.
The ConnectWise breach was a supply chain attack, Storm-0940 compromised the vendor to reach downstream customers. Your vendors' security tooling choices create transitive risk.
During due diligence, ask: "Which third-party security tools have delegated access to systems that touch our data?" Request sub-processor disclosures specific to security and monitoring platforms.
Good looks like: You maintain a register of your vendors' security sub-processors, assess their cyber risk ratings quarterly, and contractually prohibit changes without 60-day notice.
7. Implement account lockout policies that distinguish between human and automated attacks.
Microsoft noted that lockout responses represented nearly 98% of all ConnectWise attack activity. Traditional lockouts slow automated attacks but don't stop them.
Configure adaptive lockouts: after three failed attempts, require CAPTCHA. After 10, trigger temporary IP blocking. After 25, disable the application's OAuth token entirely pending manual review.
Good looks like: Your identity platform uses progressive lockout controls that escalate from friction to blocking to token revocation based on failure velocity, not just count.
8. Test your incident response timeline against sub-3-hour breach scenarios.
Storm-0940 achieved privileged access in under three hours. Your current incident response plan probably assumes you have days.
Run a tabletop exercise with this scenario: "At 9:00 AM, a vendor application begins authentication attempts at 10x normal volume. At 10:45 AM, it gains admin access. At 11:30 AM, it begins data enumeration. When do we detect? When do we contain?"
Good looks like: Your team can detect anomalous vendor authentication within 30 minutes, initiate containment within 60 minutes, and revoke vendor access within 90 minutes, all documented in a tested runbook.
Common Mistakes
Treating all authentication failures as noise. With 111,000 failed attempts in one day, it's tempting to tune out failure alerts. The mistake is not distinguishing between distributed low-volume failures (normal) and concentrated high-volume failures against specific accounts (attack indicator).
Assuming vendor MFA prevents compromise. Storm-0940 used stolen credentials for applications that were already authorized. MFA protects initial access; it doesn't prevent abuse of delegated permissions.
Focusing on user behavior analytics while ignoring application behavior. Your UBA tools watch for compromised employees. AI-driven supply chain attacks compromise applications with standing access, a different detection problem requiring different telemetry.
Next Steps
Complete items 1, 4, and 7 within 48 hours, these are configuration changes to existing identity controls. Items 2, 3, and 5 require vendor engagement; initiate those conversations this week. Item 6 belongs in your next vendor review cycle. Item 8 should happen within 30 days.
The shift from human-speed to AI-speed attacks isn't theoretical. Microsoft documented it. ConnectWise experienced it. Your supply chain is next unless your defenses match the new timeline.
