Storm-0940 used agentic AI against 2,250 Microsoft 365 tenants
Original title: China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants
After a ConnectWise Cloud Backup compromise, sign-in attempts hit 2,900 a minute and some tenants saw privileged access in under three hours.
Microsoft said China-aligned Storm-0940 compromised a ConnectWise cloud backup application and used the open-source ARTEX framework to target more than 2,250 Microsoft 365 tenants. Stolen application identities authenticated without interactive sign-ins; in some environments agents changed application credentials, identities, groups, and privileged roles. Microsoft said its own products were not compromised, most targeting failed, and an affected application or successful sign-in does not prove data theft. Customers were told to keep affected ConnectWise connections disabled and review activity from at least October 15.
Unconfirmed: Microsoft says successful authentication does not necessarily mean unauthorized data access or exfiltration, and ConnectWise did not comment.
- Microsoft says Storm-0940 has used ARTEX since as early as September 2026 and has been active since 2021.
- The group attempted sign-ins to more than 2,250 tenants at 2,900 attempts per minute.
- In some cases privileged cloud access followed in less than three hours.
- Credential and role changes can remain after the original application is remediated.
- ConnectWise published an initial Cloud Backup advisory on October 16.
Impact: Privileged Microsoft 365 access and possible persistent cloud backdoors
| Product | Affected |
|---|---|
| ConnectWise Cloud Backup | — |
- 1.Keep affected ConnectWise connections disabled until ConnectWise issues restoration instructions.
- 2.Search tenants by the four affected application IDs and do not delete those enterprise applications first.
- 3.Review activity from at least October 15, and back to October 1 where records allow.
- Vendors
- Microsoft
- Threat actors
- Storm-0940
- Malware
- ARTEX
- Victims
- ConnectWise
- Countries
- China
From the original article
4 min read at csoonline.com
A China-state-aligned threat actor compromised a ConnectWise cloud backup application and used an open-source agentic AI framework to turn its stolen credentials against more than 2,250 Microsoft 365 tenants, Microsoft said. Microsoft Threat Intelligence attributed the activity to Storm-0940, which it said has used the ARTEX framework since as early as September 2026 to automate attacks on hundreds of organizations.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.