Microsoft’s threat-intelligence unit has confirmed what security teams feared was coming: a China-state-aligned group ran a full campaign through ARTEX, an agentic AI penetration-testing framework — reaching more than 2,250 tenants at 2,900 sign-in attempts per minute, and in several documented cases going from initial targeting to privileged cloud access in under three hours. The group, tracked as Storm-0940, did it through a stolen cloud-backup vendor credential, riding the trust that thousands of companies had already placed in a ConnectWise application they had legitimately installed. This is the first campaign Microsoft describes at this level of automation detail — and the report’s own numbers explain why every organization running AI-era identity infrastructure should treat this week as a wake-up week.
Key Takeaway
- The campaign: from as early as September 2026, China-aligned Storm-0940 automated attacks on hundreds of organizations across 15+ sectors using ARTEX — an open-source, multi-agent pentest framework that can run reconnaissance through data exfiltration with minimal human input.
- The speed: over 2,250 tenants touched at 2,900 sign-in attempts per minute through compromised ConnectWise cloud applications — and multiple cases of privileged access in under 3 hours from first targeting.
- The entry: one compromised vendor credential in ConnectWise’s backup stack — the attackers authenticated as trusted apps already installed in customer tenants, no user password and no MFA prompt required.
- The persistence: the agents modified application credentials and privileged roles — in at least one reviewed tenant, a management app self-assigned Global Administrator — planting backdoors that survive even if the original compromised app gets disabled.
- The defender’s answer: disable (never delete) affected apps, audit service-principal sign-ins and Graph activity back to October 1, rotate credentials — and assume human-speed response cannot win machine-speed campaigns.
What Microsoft confirmed — the campaign timeline
The sequence Microsoft published reads like a rehearsal that graduated into a main event — Storm-0940 first automated its tradecraft, then aimed it at the entire supply chain. From as early as September 2026, Storm-0940 — active since 2021, historically a password-spray and web-exploitation actor — began using ARTEX to automate its offensive workflows against hundreds of organizations: aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, think tanks and non-profits. Between October 10 and 14, infrastructure at a single IP range conducted an automated cross-tenant password-spray against 327 accounts across eight organizations — more than 151,000 failed logons captured in telemetry, peaking at 2,900 failures per minute on October 11 and cramming over 111,000 failures into a single day. Forty-eight absorbed over 1,000 attempts each, and Storm-0940 logged none of it as waste: the spray profiled which tenants existed and how they responded. Despite the volume, not one successful authentication, token issuance, Graph call or directory change resulted from that phase — the spraying was the warm-up.
On October 15, reports surfaced of a compromise of ConnectWise’s cloud backup application — and its indicators matched the same network range from the spray. ConnectWise’s October 16 advisory shared more indicators, one matching exactly the earlier infrastructure. What Microsoft assessed happened next is the operational heart of the story: Storm-0940 had stolen a vendor credential belonging to ConnectWise’s backup platform, and Storm-0940’s AI agents used it to authenticate as ConnectWise applications that were already installed and trusted inside thousands of customer Microsoft 365 tenants — no interactive sign-in, no stolen user password, no MFA challenge. The result: Storm-0940 at machine speed, over 2,250 tenants reached at 2,900 sign-in attempts per minute, a pace Microsoft describes as leaving defenders almost no window to detect and respond.
What ARTEX is: the defenders’ tool that became the weapon
ARTEX is an open-source penetration-testing framework — built, its design implies, for the defense side. It is a multi-agent LLM system written in Go with a Next.js frontend, and it can run an autonomous penetration test end-to-end: reconnaissance through data exfiltration, with the agents accumulating discovered assets and vulnerabilities into a graph as they go. It can run on any AI model, and its interface switches from English into Korean, Mandarin, Spanish or Japanese. In legitimate hands it compresses a week of manual security testing into hours. That is the point: the same property that makes it efficient for defenders makes it a force multiplier for attackers — the tool does not know which side of the line it is on until it is aimed.
Public reporting through October flagged ARTEX in the hands of threat actors before this Microsoft report tied Storm-0940 to it definitively — including attacks on Korean financial institutions — and Microsoft Threat Intelligence says it now identifies threat actors across multiple regions using the framework. The Storm-0940 case adds the missing piece: state-scale automation plus a stolen vendor credential, producing campaigns that move at machine pace rather than team pace. Because ARTEX agents accumulate findings into a shared graph mid-operation, a Storm-0940 operator can watch its campaign learn — successful vectors feed the next tenant’s attempt, and the failure of one path barely slows the other thirteen. The lesson generalizes beyond ARTEX: every agentic security tool released to make defense faster is a candidate for exactly this inversion, and the disclosure record now shows the inversion happening in production.
The supply-chain math: which stolen backup credentials become thousands of doors
Why does one backup vendor’s credential translate into thousands of environments — and why did Storm-0940 choose a backup vendor at all? Because backup and management platforms sit in the trust hierarchy’s penthouse: a ConnectWise backup application inside a Microsoft 365 tenant holds OAuth permissions granted deliberately — mailbox access, Teams, SharePoint, Graph — because the product’s whole job is to reach everything that must be backed up. When the vendor’s own credential leaks, the attacker does not need to phish a single employee; the attacker signs in AS the application, and the tenant logs record it as legitimate vendor activity. Huntress confirmed this pattern in reviewed tenants — and found the escalation step: a ConnectWise management application self-assigning itself the Global Administrator role and then planting new credentials on other applications in the tenant. By October 17, sign-ins from the campaign’s indicators had appeared in nearly a thousand Microsoft Entra tenants, more than 300 of them successful, per Huntress’s tenant-by-tenant review.
Microsoft’s honest caveat matters: authentication does not necessarily mean data was accessed or exfiltrated, and the company states plainly that no Microsoft corporate system, product or service was compromised — this is a vendor-credential and OAuth-trust failure, not a platform vulnerability. ConnectWise disabled seven application identities on October 17 and states the stolen credential is no longer valid — but, as the security teams emphasize, previously issued access tokens stay usable until they expire, and credentials planted on OTHER apps keep working until someone finds and removes them. The trust that made the app useful persists after the trust that authorized it dies; that residue is where the Storm-0940 campaign lives for weeks. Microsoft’s defenders-facing guidance adds the sober operational note that the actor’s credential rotation on the vendor side does not reach inside tenants — the attacker-controlled secrets planted there obey no vendor clock, and only tenant-side review finds them.
The machine-speed problem defenders now face
The report’s most quotable insight is structural: AI-automated attacks generate enormous alert traffic, but the alerts arrive in seconds while defender coordination takes hours — the response clock loses before it starts. Microsoft notes the same activity conducted manually would leave audit trails and alert gaps a human team could work with; automated at ARTEX speed, the 2,900-attempts-per-minute wave compresses decision time to near zero. The asymmetry compounds downstream: each automated attempt that lands writes persistence (credentials, roles, app consents) that must be found and reversed manually, one tenant at a time. Machine-scale offense meets human-scale defense — and the gap is the entire strategic story of 2026’s threat landscape.
The countermove is equally structural, and Storm-0940 itself set its shape: put machine-speed detection and response in front of the machines. Microsoft’s own guidance pushes Defender XDR detections for suspicious Graph activity, review of service-principal sign-ins at scale, and its new Security Dashboard for AI to see agent and application risk in one view. Independent responders like Huntress and Expel are publishing tenant-level hunting queries within hours. The teams that survive this era of Storm-0940-class attacks will not be the ones with the best firewalls — the same conclusion our edge-device security coverage reached — but the ones whose response automation can match the attacker’s automation step for step.
The checklist: what to do this week
Microsoft’s mitigation list, compressed for the operator who owns a Microsoft 365 tenant — whether a two-person company or a school district:
- Disable, do not delete, the affected ConnectWise applications — deleting destroys the evidence and the forensics; disabling cuts the attacker’s path now.
- Inventory the four profiled application IDs (search by application ID, never by display name — names lie) and record each service principal’s Object ID.
- Review every tenant where ConnectWise apps were ever installed or authorized, even integrations believed retired — the abuse rode previously-granted trust.
- Audit service-principal sign-ins and Microsoft Graph activity from at least October 15, extended to October 1 where records allow; treat unfamiliar sources and post-authentication Graph recon (directory listings, app consents, role changes) as incident triggers.
- Hunt the persistence pattern: new application credentials, self-assigned privileged roles, app-role assignments to service principals, new owners/consents — and revoke + rotate on confirmation while preserving evidence.
- Apply least privilege to every multi-tenant application permission you have granted this year — the same approval-gate discipline from the OpenAI safety-monitors disclosure, applied to vendor apps instead of AI agents: both stories fail the same way, when a trusted automated identity outruns its intended purpose.
One more checklist item belongs to every vendor in the backup-and-management business: your credential hygiene is now your customers’ security posture. The ConnectWise statement commits to phased restoration with tenant-level review left to customers — the gap between ‘our credential is dead’ and ‘your tenant is clean’ is exactly where every one of these campaigns ends. Close it before you are the next headline, and keep an eye on the tooling side too: yesterday’s PHP2Shell report showed the same AI-speed dynamic on the code layer, and the monitor-evasion story showed where agent oversight still lags. Automation did not create the attack surface — it re-priced it.
FAQ
What is Storm-0940?
Storm-0940 is the Microsoft-tracked name for a China-state-aligned threat actor active since 2021, historically known for password spraying and exploiting internet-facing applications for data theft. In this campaign Microsoft attributes to it the ConnectWise cloud-backup compromise and AI-automated follow-on activity across hundreds of organizations.
What is ARTEX?
ARTEX is an open-source penetration-testing framework — a multi-agent LLM system written in Go with a Next.js frontend — that can run an autonomous pentest from reconnaissance through data exfiltration with minimal human interaction, using any AI model. Built for defenders, Microsoft now documents state-aligned actors using it to automate attacks at machine speed.
How did the attackers get into so many organizations without phishing anyone?
Through a stolen ConnectWise vendor credential. The attackers authenticated as ConnectWise applications that were already installed and trusted inside customer Microsoft 365 tenants — legitimate OAuth identities with broad permissions — so no user password or MFA prompt was ever challenged.
How fast did the campaign move?
Microsoft observed over 2,250 tenants reached at 2,900 sign-in attempts per minute, and multiple environments where the time from initial targeting to privileged access was under three hours. The password-spray phase alone generated 151,000+ failed logons in five days.
Was Microsoft itself breached?
No. Microsoft states the activity did not result from any compromise of or vulnerability in Microsoft’s own systems, products or services — the chain ran through one vendor’s leaked credential and the OAuth trust customers had granted it. Even successful authentication does not necessarily mean data was taken; each tenant must be reviewed individually.
What should I do first in my own tenant?
Disable — do not delete — the affected ConnectWise applications, search your tenant by application ID for anything related, and review service-principal sign-ins and Graph activity from October 15 back to October 1. Disable cannot fix credentials that were already planted on other apps, so hunt for new app secrets and self-assigned privileged roles, and rotate on confirmation while preserving evidence.
