Storm-0940 used ARTEX against over 2,250 Microsoft 365 tenants
Original title: China-Linked Hackers Use ARTEX AI to Target 2,250 Microsoft 365 Tenants After ConnectWise Breach
Stolen ConnectWise application credentials enabled Graph access; a separate spray of more than 151,000 logons had no successful authentication.
Microsoft attributed ConnectWise Cloud Backup follow-on activity to Storm-0940, which used the ARTEX penetration-testing framework against more than 2,250 Microsoft 365 tenants, with 2,900 sign-in attempts per minute reported. Attackers authenticated with customer-approved application credentials rather than user passwords, then inspected tenants and changed application credentials via Microsoft Graph. From October 10 to 14, infrastructure targeted 327 accounts at eight organizations. Zscaler separately described a Chinese-speaking operator combining ARTEX with AI coding tools, without tying that operator to Storm-0940. Microsoft said its own products were not compromised.
Unconfirmed: Zscaler did not show its operator is Storm-0940, and successful sign-ins are not proof of data theft.
- Earlier confirmed unauthorized sign-ins covered 173 tenants, distinct from the broader targeting count.
- Password spraying produced more than 151,000 failed logons and no successful authentication, Microsoft said.
- Microsoft said some ARTEX-driven attacks reached privileged cloud access in under three hours.
- Zscaler saved prompts sought personal, phone, payment, and transaction data; no sale was established.
- Microsoft recommends leaving affected ConnectWise connections disabled pending restoration guidance.
Impact: Tenant access through stolen app credentials and new app secrets
- 1.Keep affected ConnectWise connections disabled until formal restoration guidance.
- 2.Review service-principal sign-ins, application credential additions, consent grants, and role changes.
- 3.Check unusual Graph activity, mailbox access, downloads, forwarding rules, and unexpected owners.
- ATT&CK
- T1110.003 Password SprayingT1078.004 Cloud AccountsT1098 Account ManipulationT1528 Steal Application Access Token
- Vendors
- MicrosoftConnectWise
- Threat actors
- Storm-0940
- Victims
- ConnectWise
- Organizations
- Zscaler
- Countries
- China
- AI models
- Claude CodeCodexDeepSeekGLMGrok
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 144.172.64.128 | IoCs):- Source Type Indicator Reported context Microsoft IP 144.172.64[.]128 , 144.172.64[.]99 , 144.172.64[.]60 Sign-ins and Graph ac |
| ipv4 | 144.172.64.60 | d context Microsoft IP 144.172.64[.]128 , 144.172.64[.]99 , 144.172.64[.]60 Sign-ins and Graph activity Microsoft VPN IP 187.15.88[.] |
| ipv4 | 144.172.64.99 | Indicator Reported context Microsoft IP 144.172.64[.]128 , 144.172.64[.]99 , 144.172.64[.]60 Sign-ins and Graph activity Microsoft V |
| ipv4 | 154.201.79.246 | rvers Zscaler IP 38.244.50.120 Jump server Zscaler Endpoint 154.201.79.246:443 Proxy pool API Zscaler Endpoint 205.214.59.31:443 , 161 |
| ipv4 | 161.8.161.140 | 246:443 Proxy pool API Zscaler Endpoint 205.214.59.31:443 , 161.8.161.140:11005 Upstream SOCKS proxies Note: IP addresses and domains |
| ipv4 | 187.15.88.186 | 44.172.64[.]60 Sign-ins and Graph activity Microsoft VPN IP 187.15.88[.]186 , 187.15.90[.]217 , 187.15.89[.]186 Time-limited Graph in |
| ipv4 | 187.15.89.186 | tivity Microsoft VPN IP 187.15.88[.]186 , 187.15.90[.]217 , 187.15.89[.]186 Time-limited Graph investigation Microsoft User agent Pyt |
| ipv4 | 187.15.90.217 | n-ins and Graph activity Microsoft VPN IP 187.15.88[.]186 , 187.15.90[.]217 , 187.15.89[.]186 Time-limited Graph investigation Micros |
| ipv4 | 205.214.59.31 | Endpoint 154.201.79.246:443 Proxy pool API Zscaler Endpoint 205.214.59.31:443 , 161.8.161.140:11005 Upstream SOCKS proxies Note: IP a |
| ipv4 | 23.248.226.250 | b9b0-4137-9360-34878a929827 ConnectWise MS Graph Zscaler IP 23.248.226.250 , 23.248.226.251 , 23.248.226.252 , 23.248.226.253 , 23.248 |
| ipv4 | 23.248.226.251 | 878a929827 ConnectWise MS Graph Zscaler IP 23.248.226.250 , 23.248.226.251 , 23.248.226.252 , 23.248.226.253 , 23.248.226.254 Work ser |
| ipv4 | 23.248.226.252 | tWise MS Graph Zscaler IP 23.248.226.250 , 23.248.226.251 , 23.248.226.252 , 23.248.226.253 , 23.248.226.254 Work servers Zscaler IP 3 |
| ipv4 | 23.248.226.253 | caler IP 23.248.226.250 , 23.248.226.251 , 23.248.226.252 , 23.248.226.253 , 23.248.226.254 Work servers Zscaler IP 38.244.50.120 Jump |
| ipv4 | 23.248.226.254 | 26.250 , 23.248.226.251 , 23.248.226.252 , 23.248.226.253 , 23.248.226.254 Work servers Zscaler IP 38.244.50.120 Jump server Zscaler E |
| ipv4 | 38.244.50.120 | 2 , 23.248.226.253 , 23.248.226.254 Work servers Zscaler IP 38.244.50.120 Jump server Zscaler Endpoint 154.201.79.246:443 Proxy pool |
From the original article
3 min read at cybersecuritynews.com
China-state-aligned hackers used ARTEX, an AI-powered penetration-testing framework, to attempt access to more than 2,250 Microsoft 365 tenants following the ConnectWise Cloud Backup breach. Microsoft attributed the attack to Storm-0940 and reported 2,900 sign-in attempts per minute, leaving security teams little time to investigate and block access.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.