Storm-0940 used ARTEX AI in ConnectWise supply-chain attacks
Original title: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Microsoft says privileged cloud access sometimes took under three hours, with more than 2,250 tenants targeted.
Microsoft said China-aligned Storm-0940 began using the open-source agentic penetration-testing framework ARTEX as early as September 2026 against hundreds of organizations worldwide. Microsoft assesses the group carried out the disclosed ConnectWise multi-tenant application compromise and then abused already-authorized applications to reach Microsoft 365 tenants without an interactive sign-in. Follow-on Graph activity included reconnaissance, application credential changes, and privilege-modification attempts. Microsoft said this did not stem from a flaw in Microsoft systems, and that authentication alone does not show customer data was taken.
Unconfirmed: Microsoft assesses Storm-0940’s role in the ConnectWise compromise; it says successful authentication does not prove data was accessed or exfiltrated.
- Storm-0940 has been active since 2021 and has no known industry aliases.
- Some attacks reached privileged cloud access in under three hours.
- ARTEX activity hit more than 2,250 tenants at 2,900 sign-in attempts per minute.
- ConnectWise reported unauthorized OAuth application access on October 16, 2026.
- Targets included defense, energy, government, finance, and other sectors.
Impact: Privileged cloud access via abused OAuth applications; data theft not confirmed
| Product | Affected |
|---|---|
| ConnectWise multi-tenant OAuth application | — |
- 1.Review service principal sign-ins and unexpected application credential or privilege changes.
- 2.Follow ConnectWise’s published containment guidance and preserve evidence.
- 3.Use Microsoft Defender XDR detections and hunting queries for Graph and known infrastructure.
- ATT&CK
- T1110.003 Password SprayingT1195.002 Compromise Software Supply ChainT1098.001 Additional Cloud CredentialsT1550.001 Application Access Token
- Vendors
- MicrosoftConnectWise
- Products
- Microsoft 365Microsoft Graph
- Threat actors
- Storm-0940
- Malware
- ARTEX
- Countries
- China
From the original article
12 min read at microsoft.com
Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments. The post AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise appeared first on Microsoft Security Blog.
By Microsoft Security Research and Microsoft Threat Intelligence · microsoft.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.