Microsoft Links Storm-0940 to ConnectWise Breach Using ARTEX AI Agents

Microsoft disclosed on October 21 that the China-state-aligned threat actor Storm-0940 was responsible for the recent supply chain compromise of the ConnectWise Cloud Backup application. The tech giant reported that the group used the ARTEX agentic AI penetration testing framework to accelerate attacks against downstream victims since September 2026. This disclosure follows ConnectWise’s own breach advisory from October 16 and initial reporting by Huntress on the same day.

Storm-0940 leveraged ARTEX to automate reconnaissance, password spraying, and OAuth application abuse at machine speed. According to Microsoft, the attackers attempted to sign in to more than 2,250 Microsoft 365 tenants, generating 2,900 sign-in attempts per minute. This rapid pace significantly reduced the window available for defenders to detect and respond to the unauthorized access attempts.

Technical Execution and Timeline

The attackers exploited stolen application credentials and permissions already approved by customers, bypassing the need for interactive user sign-ins. Microsoft noted that this method allowed the threat actor to authenticate to target environments using applications that had previously been granted access. By operating as trusted applications, the group could inspect environments and modify privileges without triggering traditional user-based alerts.

Between October 10 and 14, Storm-0940’s infrastructure targeted 327 accounts across eight organizations, resulting in more than 151,000 failed logons during password-spray activity. Microsoft observed no successful authentication during that specific phase. However, in the broader ConnectWise incident, the group successfully compromised multiple application identities to gain control.

After establishing access, the attackers used Microsoft Graph to change application credentials and add new authentication keys. These actions included modifying administrator roles and adding credentials to existing OAuth applications. Microsoft stated that several of these ARTEX-driven attacks resulted in privileged cloud access in under three hours, enabling persistent entry even if original connections were disabled.

Scope and Impact

The campaign targeted organizations across a wide range of sectors, including aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and non-profits. Microsoft assessed that Storm-0940 has been active since at least 2021 and previously used the Quad7 botnet for evasive password spray attacks.

While Microsoft reported broad targeting of 2,250 tenants, other firms documented confirmed breaches at fewer locations. Huntress had confirmed breaches at 162 tenants by October 16, and earlier reporting on compromised credentials documented unauthorized sign-ins across 173 tenants. Microsoft cautioned that not every attempted sign-in succeeded and that successful authentication alone does not prove data theft.

Zscaler researchers separately documented ARTEX abuse in a report published on October 21. They examined a Chinese-speaking operator’s workflow, showing how the group combined ARTEX with AI workspaces like Claude Code and Codex. Zscaler did not establish that its investigation covered the same actor as Microsoft’s Storm-0940 attribution.

What should you do?

Security teams should review logs for high volumes of sign-in attempts from application identities, especially those exceeding normal baselines. Administrators should audit OAuth application permissions and remove any unnecessary grants or unused authentication keys. Organizations should monitor for changes to administrator roles and application credentials, as these indicate potential persistence mechanisms.

Background: OAuth

The difference between OAuth and API key lies in identity and scope. An API key acts as a static password identifying a project or client to a system. OAuth is an authorization framework that allows third-party applications to obtain limited access to user accounts without exposing credentials.

Read the full guide: Difference Between OAuth and API Key and How to Choose

What to do and how to stay safe: Storm-0940

• Audit all OAuth applications and service principals for unused or overly permissive credentials, removing any that are not actively required for business operations.
• Enable advanced logging for application sign-ins to detect rapid, automated authentication attempts that may indicate AI-driven credential abuse.
• Review recent changes to administrator roles and application permissions to identify unauthorized modifications that could facilitate persistent access.
• Implement conditional access policies that restrict sign-ins from unfamiliar locations or devices, even for trusted application identities.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is ARTEX and why was it used in this attack?

ARTEX is a Go-based agentic AI penetration testing framework that attackers used to automate scanning and credential abuse at machine speed.

How many tenants were targeted by Storm-0940?

Microsoft reported that the group attempted to sign in to more than 2,250 Microsoft 365 tenants following the ConnectWise breach.

Did the attackers use user passwords to gain access?

No, the attackers abused stolen application credentials and permissions already granted to the ConnectWise Cloud Backup service.