Storm-0940 uses ARTEX AI agents in ConnectWise supply chain attack

1. Executive summary

Microsoft attributes the ConnectWise Cloud Backup supply chain compromise to Storm-0940, a China state-aligned actor active since 2021, which used the Go-based agentic AI framework ARTEX to automate reconnaissance, password spraying and OAuth application abuse against downstream Microsoft 365 tenants. The actor attempted authentication against more than 2,250 Microsoft 365 tenants using application credentials customers had already granted to ConnectWise services, at times reaching 2,900 attempts per minute, and established persistent privileged access at a number of organisations, with some intrusions moving from targeting to privileged cloud access in under three hours. Storm-0940 has no MITRE ATT&CK profile, so the attribution to a China state-aligned actor rests on Microsoft's assessment and is unconfirmed by independent reporting. No CVE is associated with this item and no CISA KEV entry applies; the exposure is abuse of legitimately granted OAuth permissions, not a software flaw. EMEA financial services firms running ConnectWise Cloud Backup, SaaS Security or Cloud Management, or holding OAuth grants to those services in Microsoft 365, should treat their tenant as potentially targeted and review service principal sign-in and application credential activity now.

2. Regulatory framing

3. Technical analysis & attack chain

Microsoft's account describes a supply chain compromise of a ConnectWise multi-tenant application, with the actor using stolen application identities to authenticate into customer Microsoft 365 tenants. The confirmed sequence, as Microsoft reports it:

1. Storm-0940 obtained privileged access to ConnectWise cloud infrastructure hosting the Cloud Backup, SaaS Security and Cloud Management services. ConnectWise discovered unauthorised access to application identities and pulled the affected services.
2. The actor used ARTEX, a Go-based agentic AI penetration testing framework, to automate scanning and reconnaissance against a broad target set. Microsoft lists aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits.
3. Between 10 and 14 October 2026, the actor made more than 151,000 failed sign-in attempts against 327 accounts at eight organisations (password spraying). Microsoft observed no successful logins from that campaign.
4. The actor shifted to compromised ConnectWise application identities. These credentials let it authenticate to Microsoft 365 customer environments through applications that had already been granted access, with no interactive user sign-in required.
5. Using ARTEX, the actor attempted authentication against more than 2,250 Microsoft 365 tenants, at times at 2,900 attempts per minute. Most attempts failed; Microsoft reports persistent privileged access established at numerous organisations.
6. In affected environments Microsoft observed AI-accelerated follow-on activity through Microsoft Graph: reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access. Changing application credentials is the mechanism by which access can survive revocation of the original ConnectWise credentials.

The technical significance for defenders is that no vulnerability was exploited in the customer tenant. The access path was the OAuth permission grant the customer had already issued to the ConnectWise application. Revoking the ConnectWise application's connections at the provider does not remove an attacker who has already added credentials to an existing OAuth application inside the tenant. Microsoft states the activity did not result from a compromise of or a vulnerability in Microsoft corporate systems, products or services.

Storm-0940's historical tradecraft, per Microsoft: initial access through password spraying and exploitation of internet-facing applications, then movement with compromised accounts; in cloud environments, persistence by adding credentials to existing OAuth applications, and data access and exfiltration of email and other data through Microsoft Graph. The actor has targeted multiple industries for data theft since 2021.

Confidence caveats. The attribution to a China state-aligned actor is Microsoft's assessment; Storm-0940 has no MITRE ATT&CK profile and The Register carries the same attribution without independent corroboration, so treat it as single-sourced to Microsoft. Microsoft has not disclosed how many customers were compromised or whether data was accessed or exfiltrated, and states that a successful authentication does not by itself indicate data access. The 2,250-tenant and 2,900-per-minute figures come from Microsoft via The Register and are not independently verified. ARTEX is described as open source by The Register and as having been made closed-source after abuse against South Korean financial institutions in the primary item; Microsoft's post does not resolve that difference, and the framework is reported in use by actors from several geographic regions, so ARTEX use alone does not indicate Storm-0940.

4. Mitigation & containment

P1 within 24 hours

• Inventory every OAuth application consent and service principal in the Microsoft 365 tenant that maps to ConnectWise Cloud Backup, SaaS Security or Cloud Management. For each, pull service principal sign-in logs and application credential changes for the period from September 2026 onward. Microsoft's guidance is to review service principal sign-ins and investigate unexpected application credential or privilege changes.
• Where a ConnectWise application shows sign-in activity the business cannot account for, remove the application's credentials and grants, then re-issue only after ConnectWise confirms containment. Preserve sign-in, audit and Graph activity logs before making changes.
• Enable and tune Microsoft Defender XDR detections and hunting queries for suspicious Microsoft Graph activity and for the known threat infrastructure Microsoft published alongside its report.
• Apply ConnectWise's published containment guidance for the affected services and track its restoration notices; do not restore application connections until ConnectWise confirms the application identities are clean.

P2 within 72 hours

• Hunt Microsoft Graph activity in the affected window for the behaviours Microsoft names: directory reconnaissance, application credential additions, and privilege modifications on service principals and applications. Any credential added to an existing OAuth application by an unexpected principal is a persistence indicator and warrants credential rotation and grant review.
• Enforce conditional access and sign-in restrictions on service principals and workload identities where the tenant supports it, so application-only authentication is constrained by network location or workload identity policy rather than accepted from any source.
• Review password spray exposure: the 151,000 failed attempts against 327 accounts at eight organisations produced no successful logins, but confirm your own failed-sign-in baselines and lockout thresholds against that volume.

P3 within 7 days

• Add ConnectWise and comparable SaaS providers to the third-party risk review with the specific question of which OAuth scopes they hold and how provider-side compromise would be detected. This is the control DORA Art. 28 and Art. 30 and NIS2 Art. 21(2)(d) point at.
• Tabletop the provider-compromise scenario: the provider revokes its connections, the attacker retains a credential added to an OAuth application, and the firm must detect and evict it without provider assistance.

5. Indicators of compromise

No atomic indicators (hashes, domains, IP addresses, file paths) are present in the source material. Microsoft's post references detections and hunting queries for suspicious Microsoft Graph activity and known threat infrastructure but the indicator values are not reproduced in the sources provided.

Behavioural indicators

6. Detection

The sources give behavioural material but no artefact strings from the threat itself (no filenames, command lines, mutexes, registry keys or hard-coded values). A YARA rule built on product names or actor names would detect reporting about the threat, not the threat, so none is emitted. The Sigma rule below targets the service principal sign-in and application credential behaviour Microsoft describes.

title: ConnectWise Application Service Principal Sign-In and Credential Change
id: 7c1e4a92-3b6d-4f18-9a2e-5d0c8b7f1e34
status: experimental
description: Detects application-only authentication and credential or privilege changes on service principals associated with ConnectWise cloud services, consistent with Storm-0940 abuse of granted OAuth permissions.
author: Adverse Trace
date: 2026-10-22
references:

  - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
  - https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html
logsource:
  product: azure
  service: auditlogs
detection:
  selection_sp_signin:
    operationName:

      - 'Sign-in activity'
    properties.message|contains:

      - 'ConnectWise'
  selection_cred_change:
    operationName:

      - 'Update application'
      - 'Add service principal credentials'
      - 'Update service principal'
      - 'Add app role assignment grant to user'
  filter_known_admin:
    initiatedBy.user.userPrincipalName|endswith:

      - '@trusted-admin-domain.example'
  condition: (selection_sp_signin or selection_cred_change) and not filter_known_admin
falsepositives:

  - Legitimate administrative rotation of ConnectWise application credentials
  - Scheduled secret renewal by an approved automation account
level: high

The filter_known_admin value is a placeholder; replace it with the firm's own administrative domain before deployment. The rule keys on the ConnectWise application name and on Entra ID application management operations, both of which appear in the sources; it does not detect ARTEX itself, for which no artefacts are available.

7. Sources

• Microsoft Threat Intelligence, "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise", 2026-10-21. https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
• The Hacker News, "China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack", 2026-10-22. https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html
• The Register, "Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants", 2026-10-22. https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687

8. Adverse Trace position

Adverse Trace assesses this as a high-impact supply chain intrusion for EMEA financial services firms that hold ConnectWise cloud service grants in Microsoft 365, because the access path bypasses user authentication and the actor has demonstrated persistence through application credential changes that survive provider-side revocation. No CVE or CISA KEV entry applies, so severity here is driven by exposure and blast radius rather than a patchable flaw. The attribution to a China state-aligned actor is Microsoft's assessment and is unconfirmed: Storm-0940 has no MITRE ATT&CK profile and no independent source in this set corroborates it, so we present it as single-sourced. We will monitor ConnectWise's restoration notices and Microsoft's published detections and hunting queries, and we will issue a follow-up if Microsoft or ConnectWise discloses the number of compromised tenants or confirms data access. Clients running the affected ConnectWise services should complete the P1 tenant review and report back to us with the service principal sign-in findings so we can assess whether escalation to a DORA Art. 19 major incident notification is warranted.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.