Storm-0940 uses ARTEX AI to compromise ConnectWise supply chain and abuse OAuth

1. Executive summary

Microsoft attributes a supply chain compromise of ConnectWise multi-tenant applications to Storm-0940, a China-state aligned actor active since 2021, and reports that the actor used the open-source agentic AI framework ARTEX to drive password spraying, OAuth application abuse and Microsoft Graph follow-on activity at downstream tenants. The actor reached more than 2,250 tenants at up to 2,900 sign-in attempts per minute, and Microsoft recorded cases where the time from initial targeting to privileged cloud access was under three hours. No CVE, CVSS score or CISA KEV entry is associated with this item: the access path is abuse of legitimately granted OAuth application permissions, not a software vulnerability. EMEA financial services firms that use ConnectWise cloud backup or partner tooling, or that hold any third-party OAuth application with tenant-wide Graph permissions, should treat their service principal sign-in logs as the primary evidence source and review them back to 13 October 2026.

2. Regulatory framing

3. Technical analysis & attack chain

Microsoft's account describes two linked phases: an automated cross-tenant password-spray campaign, then abuse of OAuth application identities taken from the ConnectWise compromise. The confirmed sequence:

1. Between 10 and 14 October 2026, infrastructure at 144.172.64[.]99 ran an automated cross-tenant password spray against 327 accounts across eight organisations to reach Microsoft 365 and Exchange Online. Microsoft telemetry recorded more than 151,000 failed logon events, peaking on 11 October at 2,900 failures per minute, with more than 111,000 failures in that single day. The campaign mixed broad low-rate spraying with sustained high-volume attempts against selected identities; 48 accounts took more than 1,000 failures each. Lockout responses were nearly 98% of all activity. Microsoft observed no successful authentication, token issuance, Graph call or directory change from this phase.
2. On 15 October, public reporting of the ConnectWise compromise began to reference indicators in the same 144.172.64.x range. ConnectWise published its own advisory on 16 October, and one of its indicators matched 144.172.64[.]99 exactly.
3. After taking control of multiple ConnectWise cloud application identities, the actor's agents authenticated to customer environments from the same IP range using the stolen application credentials. Because the applications already held consent and trust inside each tenant, no interactive user sign-in was needed.
4. In some environments the agents moved past authentication into Microsoft Graph and directory operations: reconnaissance, application credential modification to establish persistence, and changes to identities, groups and privileged roles. Microsoft's Defender coverage includes a detection for a ConnectWise management application granting itself the Global Administrator role through an Add member to role operation with no prior self-assignment in the preceding seven days.
5. Microsoft reports the actor reached more than 2,250 tenants at 2,900 sign-in attempts per minute during the ConnectWise phase.

ARTEX is an open-source, multi-agent LLM penetration testing framework written in Go with a Next.js frontend. Its interface and output default to English and can be switched to Korean, Mandarin, Spanish or Japanese. The agents run reconnaissance through data exfiltration with little human interaction and accumulate discovered assets and vulnerabilities into a graph during the test. Microsoft states the framework can drive any AI model. Public reporting in October 2026 linked ARTEX to personal data breaches at Korean financial institutions, and Microsoft says it has seen actors in multiple regions using it.

The actor's historical pattern is password spraying and exploitation of internet-facing applications for initial access, then persistence by adding credentials to existing OAuth applications, then email and data exfiltration through Microsoft Graph. The ConnectWise phase follows that pattern with the automation layer added.

Two caveats. First, the attribution to Storm-0940 as a China-state aligned actor is Microsoft's assessment and rests on that single vendor's reporting; no MITRE ATT&CK profile for Storm-0940 is available, so the attribution is unconfirmed and should not be used as the sole basis for blocking or escalation decisions. Second, Microsoft states explicitly that the presence of an affected application, or a successful actor authentication, does not by itself establish that customer data was accessed or exfiltrated. Treat Graph activity as the evidence that matters, and note that Microsoft warns absence of Graph log results is not proof that no access occurred.

4. Mitigation & containment

P1, within 24 hours:

• Inventory the four affected application IDs in Entra ID and confirm whether each is present, enabled, admin-consented and what Graph permissions it holds: 506e08f9-6e9a-4da4-942b-a099a03644ae (ConnectWise Cloud Backup), 24205314-2b89-4e07-a2a4-579e898a5640 (ConnectWise MS Teams), 0de14c77-b9b0-4137-9360-34878a929827 (ConnectWise MS Graph), c921256f-04a7-44e8-9b2a-69c33929ba19 (SkyKick Partner Portal).
• Pull service principal sign-ins for those application IDs back to 13 October 2026 and filter on 144.172.64.60, 144.172.64.99 and 144.172.64.128. Correlate with MicrosoftGraphActivityLogs on the same AppId and IP set. Where the tenant has no Graph activity logging enabled, enable it before concluding anything from an empty result.
• Review every application credential change and every app role assignment made since 13 October. Microsoft's detection logic flags a service principal adding an application role assignment to itself, and a ConnectWise management application self-assigning Global Administrator. Revoke any credential or role grant that cannot be tied to an authorised change ticket.
• Follow ConnectWise's published containment and restoration guidance and preserve sign-in, Graph and audit logs before rotating credentials, so the evidence survives remediation.
• Block 144.172.64.60, 144.172.64.99 and 144.172.64.128 at egress and in identity risk policy. Treat the 187.15.88[.]186, 187.15.90[.]217 and 187.15.89[.]186 VPN addresses as investigation leads for 15 and 16 October only; they are transient.

P2, within 72 hours:

• Hunt for the user agents listed in §5 against the affected application IDs. Python and curl user agents authenticating as a cloud backup or Teams integration are not normal.
• Reduce standing privilege on third-party applications: remove tenant-wide Graph application permissions that the integration does not need, and replace app-only mail and SharePoint access with scoped permissions where the vendor supports it.
• Review conditional access for workload identities so that service principal sign-ins from hosting and VPN ranges are challenged or blocked.

P3, within 7 days:

• Add the ConnectWise application IDs and the three IPs to standing analytics rules rather than one-off hunts.
• Audit all OAuth applications with admin consent across the tenant, not only ConnectWise, and record the business owner for each.
• Test the incident process against a three-hour compromise window. Microsoft's point is that the activity generates alerts but leaves no time for a coordinated response at human speed; a playbook that assumes a day to triage will not work here.

5. Indicators of compromise

The IP and user agent set is single-sourced to Microsoft. The user agents are generic library strings and will produce false positives; scope them to sign-ins by the ConnectWise application IDs before alerting.

ipv4  144.172.64[.]128
ipv4  144.172.64[.]99
ipv4  144.172.64[.]60
ipv4  187.15.88[.]186
ipv4  187.15.90[.]217
ipv4  187.15.89[.]186
user_agent  Python-urllib/3.12
user_agent  python-requests/2.31.0
user_agent  python-requests/2.34.2
user_agent  curl/7.88.1
user_agent  azure-toolkit/1.0

Behavioural indicators:

6. Detection

The sources give no file artefacts, so a YARA rule would have nothing to match. Detection here is identity and Graph telemetry. The Sigma rule below targets the service principal sign-in and role-assignment behaviour Microsoft describes; substitute your own field names if your schema differs from the Sentinel table names used in Microsoft's hunting queries.

title: ConnectWise OAuth Application Sign-in from Storm-0940 Infrastructure
id: 7c1e4a92-3b6d-4f18-9a2e-5d0b8c3f1e64
status: experimental
description: Detects service principal sign-ins by ConnectWise cloud applications from IP ranges Microsoft attributed to Storm-0940 ARTEX activity, and self-assignment of privileged app roles.
author: Adverse Trace
date: 2026-10-21
references:

  - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
logsource:
  product: azure
  service: signinlogs
detection:
  selection_app:
    AppId:

      - '506e08f9-6e9a-4da4-942b-a099a03644ae'
      - '24205314-2b89-4e07-a2a4-579e898a5640'
      - '0de14c77-b9b0-4137-9360-34878a929827'
      - 'c921256f-04a7-44e8-9b2a-69c33929ba19'
  selection_ip:
    IPAddress|cidr:

      - '144.172.64.0/24'
  selection_ua:
    UserAgent|contains:

      - 'Python-urllib/3.12'
      - 'python-requests/2.31.0'
      - 'python-requests/2.34.2'
      - 'curl/7.88.1'
      - 'azure-toolkit/1.0'
  condition: selection_app and (selection_ip or selection_ua)
falsepositives:

  - Legitimate vendor automation running from Python or curl clients; scope to the four application IDs and confirm with the vendor.
level: high

title: Service Principal Self-Assignment of Privileged Application Role
id: b83f0d51-6a27-4c9e-8f13-2e7a9d4b6c05
status: experimental
description: Detects a service principal adding an application role assignment to itself, including a ConnectWise management application self-assigning Global Administrator.
author: Adverse Trace
date: 2026-10-21
references:

  - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
logsource:
  product: azure
  service: auditlogs
detection:
  selection_op:
    OperationName:

      - 'Add member to role'
      - 'Add app role assignment grant to service principal'
  selection_self:
    InitiatedBy|contains: 'ServicePrincipal'
  condition: selection_op and selection_self
falsepositives:

  - Approved automation that provisions its own role assignments; require a matching change record.
level: high

7. Sources

• Microsoft Security Blog, "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise", 2026-10-21. https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
• ConnectWise customer advisory referenced by Microsoft, posted 2026-10-16. Not retrieved for this advisory; the indicator overlap with 144.172.64[.]99 is reported by Microsoft.

8. Adverse Trace position

No CVE, CVSS score or CISA KEV entry applies to this item, so severity rests on exposure rather than a patch rating: any tenant that has granted tenant-wide Graph consent to a ConnectWise application, or to any third-party integration it has not reviewed, is in scope, and Microsoft's sub-three-hour compromise times mean the detection window is measured in hours. The attribution to Storm-0940 as China-state aligned is Microsoft's assessment and is unconfirmed against MITRE ATT&CK, which holds no profile for the actor; the IOC set is likewise single-sourced, so verify before enforcing blocks on the VPN addresses. We will monitor for ConnectWise's own advisory detail and for any second vendor corroboration of the 144.172.64.0/24 infrastructure, and we will reissue this note if either changes the picture. Clients should prioritise the P1 service principal review over any perimeter action, because the access path runs through credentials the tenant already trusts.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.