Storm-0940 uses AI tool ARTEX to breach 2,250 M365 tenants via ConnectWise

1. Executive summary

Microsoft attributes a supply chain compromise of ConnectWise Cloud Backup (formerly SkyKick) to Storm-0940, a China-state-aligned actor active since 2021, which used a stolen application credential to authenticate against more than 2,250 Microsoft 365 tenants between roughly 10 and 15 October 2026. The actor drove the campaign with ARTEX, a Go-based agentic AI penetration-testing framework, reaching privileged cloud access in under three hours in some cases and at times sustaining 2,900 authentication attempts per minute. No CVE is associated with this item and no CISA KEV entry applies; the exposure is abuse of legitimately granted OAuth application permissions, not a software vulnerability. Storm-0940 has no MITRE ATT&CK profile in the data available to Adverse Trace, so the attribution to a named actor is unconfirmed and rests on Microsoft's assessment. EMEA financial services firms whose M365 tenants have granted access to ConnectWise Cloud Backup, SaaS Security or Cloud Management should treat their service principals as potentially compromised and hunt for credential additions and privilege changes made through Microsoft Graph.

2. Regulatory framing

3. Technical analysis & attack chain

The intrusion abused a credential belonging to the ConnectWise Cloud Backup application, not a vulnerability in Microsoft 365 or in ConnectWise's code. Cloud Backup keeps copies of email, OneDrive, SharePoint files and Teams chats for MSP customers. To do that, an administrator at each client grants the application broad permissions through Microsoft Entra ID, and the app then exists in the tenant as an application identity (service principal) able to read and write data without any person signing in. The stolen credential works in every organisation that granted the app access, so a single compromise at the vendor reached customers of many MSPs at once. That is why Microsoft classifies the incident as a supply chain attack.

Confirmed sequence, drawn from Microsoft's reporting and Huntress's telemetry:

1. From as early as September 2026, Storm-0940 used ARTEX to automate reconnaissance, scanning and password spraying against organisations worldwide, including financial services, government, defence, energy and legal.
2. Between 10 and 14 October, the actor made more than 151,000 failed sign-in attempts against 327 accounts at eight organisations. Microsoft observed no successful logins from that spraying.
3. The actor shifted to the compromised ConnectWise application identity. Huntress recorded the stolen credential used on 15 October between 06:13 and 08:34 UTC to sign in as the backup application from 144.172.64[.]128, a hosting-provider address rather than Microsoft cloud infrastructure. The same address had been used on 13 and 14 October to guess passwords at four law firms, without success.
4. Sign-ins moved through customer accounts a few seconds apart in a fixed order, consistent with an automated script working from a target list. Microsoft counted authentication attempts against more than 2,250 M365 tenants, peaking near 2,900 per minute.
5. Follow-on activity ran through Microsoft Graph: reconnaissance, application credential changes, and attempts to modify privileges. Adding credentials to existing OAuth applications is a persistence method Storm-0940 has used before in cloud environments, and it can survive revocation of the original credential.
6. In one tenant Huntress examined, the ConnectWise Cloud Management app for Microsoft Teams made itself a global administrator hours before the main sweep and, within about five minutes, added new credentials to two other trusted applications in that account, an MSP management application and Huntress's own application. Those credentials were set to remain valid until 2028.

Impact is uneven and partly unresolved. Microsoft says most attempts failed but that the actor established persistent privileged access at numerous organisations. It has not disclosed how many customers were compromised or whether data was stolen, and cautions that a successful login does not by itself mean information was accessed. Huntress confirmed unauthorised access to at least 162 M365 tenants and found nearly 1,000 accounts with sign-in attempts from the attackers' address, more than 300 of them successful. Todyl separately confirmed impacts from the same attack. ConnectWise disabled seven application identities, including ConnectWise Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae), and suspended Cloud Backup, SaaS Security and Cloud Management.

Two caveats matter for defenders. First, Huntress saw other ConnectWise Cloud Management applications grant themselves administrator roles, mostly Exchange Administrator, in roughly 50 organisations it monitors; the software signature on those events matched ConnectWise's own apps, suggesting vendor automation rather than the attacker, but ConnectWise has not confirmed this. Treat self-granted admin roles as ambiguous until the vendor says otherwise. Second, the IP address is reported inconsistently across sources: Huntress and Cybersecurity Dive give 144.172.64[.]128, while one Cybersecurity Dive passage gives 142.172.64[.]128. The 144.172.64[.]128 value is corroborated by two sources and is the one to hunt on; verify both before blocking.

Attribution is single-sourced to Microsoft. The Register and The Hacker News repeat Microsoft's assessment; no independent attribution to Storm-0940 exists in the material reviewed, and the actor has no MITRE ATT&CK profile. Microsoft states the activity did not result from a compromise of or vulnerability in Microsoft's own systems, products or services. There is nothing to suggest a link to the May 2025 ScreenConnect incident. Microsoft also reports other, geographically varied actors using ARTEX, so tool presence alone does not identify Storm-0940.

4. Mitigation & containment

P1, within 24 hours:

• Inventory every service principal in your Entra ID tenant tied to ConnectWise Cloud Backup, SaaS Security and Cloud Management, and confirm whether the seven identities ConnectWise disabled are still consented in your tenant. Revoke consent for any you no longer need.
• Hunt Microsoft Graph and Entra ID sign-in logs for service principal authentication from 144.172.64[.]128 and 142.172.64[.]128 between 13 and 15 October 2026. Pull the full sign-in and audit record set before it ages out; ConnectWise's own guidance is to preserve sign-in and audit records while containing.
• Review every application credential added or modified in the window, and every privilege grant to an application. Remove credentials you cannot account for, and specifically check for credentials with expiry dates set years out (Huntress saw 2028).
• Check for unauthorised mailbox forwarding, inbox rules and delegated mailbox access, per ConnectWise's recommendations, and investigate any other identity changed or used during the suspicious activity.

P2, within 72 hours:

• Review federation trusts and application consent grants tenant-wide. Where an MSP holds delegated access, obtain from the MSP the list of tenants it manages for you and its containment status.
• Rotate credentials for any application that held Graph permissions during the window, and re-issue with the narrowest scope that still supports backup.
• Enable and tune Microsoft Defender XDR detections for suspicious Microsoft Graph activity and known threat infrastructure; Microsoft published hunting queries alongside its report.

P3, within 7 days:

• Add service principal sign-in anomalies (new credential added, privilege escalation, sign-in from hosting-provider address space) to standing monitoring, not just this incident's review.
• Amend ConnectWise and MSP contracts to require notification of application-identity compromise and provision of audit records, consistent with the DORA Art. 30 exposure above.
• Restrict outbound authentication to Microsoft cloud ranges where operationally possible, so a backup application signing in from a hosting provider is anomalous by construction.

5. Indicators of compromise

The sources describe observable behaviours but few atomic indicators. The IP address is the only network indicator; the application ID identifies the abused service principal, not attacker infrastructure. Verify the IP discrepancy before enforcement.

ipv4  144.172.64[.]128
ipv4  142.172.64[.]128
application_id  506e08f9-6e9a-4da4-942b-a099a03644ae

Behavioural indicators

6. Detection

The sources give no file artefacts, so a YARA rule would have nothing genuine to match. Detection here is identity and Graph telemetry, so the rule is Sigma.

title: ConnectWise Application Credential Abuse and Privilege Escalation
id: 8f3c2a71-4b6e-4d19-9a2f-7c5e1d0b3a64
status: experimental
description: Detects service principal sign-ins from hosting-provider addresses and credential or privilege changes consistent with the Storm-0940 ConnectWise Cloud Backup abuse.
author: Adverse Trace
date: 2026/10/22
references:

  - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
  - https://www.helpnetsecurity.com/2026/10/19/connectwise-cloud-backup-suspended-security-incident/
logsource:
  product: azure
  service: signinlogs
detection:
  selection_ip:
    IPAddress:

      - '144.172.64.128'
      - '142.172.64.128'
  selection_app:
    AppId: '506e08f9-6e9a-4da4-942b-a099a03644ae'
  condition: selection_ip or selection_app
falsepositives:

  - Legitimate ConnectWise backup operations from vendor infrastructure
level: high

A second rule for the credential-addition behaviour, which is the persistence that survives revocation:

title: OAuth Application Credential Added or Privilege Granted to Service Principal
id: 2d9b7e14-6a3f-4c88-b5e1-0f4a7c9d2e13
status: experimental
description: Detects credentials added to existing applications and application role grants, the persistence method observed in the ConnectWise Cloud Backup compromise.
author: Adverse Trace
date: 2026/10/22
references:

  - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    OperationName:

      - 'Add service principal credentials'
      - 'Update application - Certificates and secrets management'
      - 'Add member to role'
  condition: selection
falsepositives:

  - Scheduled credential rotation by the application owner
  - ConnectWise Cloud Management self-granting Exchange Administrator (vendor automation, unconfirmed)
level: medium

7. Sources

• Microsoft Threat Intelligence, "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise", 2026-10-21. https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
• The Register, "Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants", 2026-10-22. https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687
• Help Net Security, "ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access", 2026-10-19. https://www.helpnetsecurity.com/2026/10/19/connectwise-cloud-backup-suspended-security-incident/
• The Hacker News, "China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack". https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html
• The Hacker News, "Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants". https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html
• The Hacker News, "ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants". https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html
• Cybersecurity Dive, "ConnectWise suspends Cloud Backup service as hacker targets Microsoft 365 users". https://www.cybersecuritydive.com/news/connecwise-suspends-cloud-backup-hacker-microsoft-365/833345/

8. Adverse Trace position

No CVE is associated with this item and no CISA KEV entry applies, so there is no patch deadline and no CVSS score to quote; the severity sits in the identity layer, where a single vendor credential reached more than 2,250 tenants and the actor established persistent privileged access at an undisclosed number of them. The attribution to Storm-0940 is Microsoft's assessment alone and the actor has no MITRE ATT&CK profile, so we treat it as unconfirmed; the technical facts (credential abuse, Graph reconnaissance, credential additions valid to 2028) are corroborated by Huntress and Todyl telemetry and stand independently of who did it. For EMEA financial services clients, the exposure is concentrated in firms that granted ConnectWise Cloud Backup, SaaS Security or Cloud Management tenant-wide Graph permissions, directly or through an MSP; those firms should assume their service principals were reachable and hunt the credential-addition and privilege-change events before the logs age out. Adverse Trace will monitor ConnectWise's restoration notices and Microsoft's detection guidance for updates, and will reissue this advisory if Microsoft discloses the number of compromised customers or confirms data access.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.