Microsoft Ties Storm-0940 to ARTEX-Driven ConnectWise Hack
TL;DR
- Huntress confirmed 162+ tenants breached and attackers assigned themselves Global Admin roles within five minutes of gaining initial access.
- Microsoft logged 151,000+ failed sign-in attempts across eight organizations October 10-14, peaking at 2,900 per minute on October 11 alone.
- ARTEX agents exploited pre-granted OAuth permissions to authenticate as the backup application, bypassing interactive user sign-in requirements entirely.
In some cases, Microsoft says, attackers achieved "privileged access to an organization's cloud infrastructure" in "less than 3 hours" from initial targeting.
The disclosure came Wednesday from Microsoft, which tied the recent ConnectWise Cloud Backup supply chain compromise to a China state-aligned actor it tracks as Storm-0940. The group ran the operation through ARTEX, a Go-based agentic AI penetration testing framework that was pushed closed-source after being abused in attacks on South Korean financial institutions.
Between October 10 and 14, 2026, Microsoft says infrastructure at 144.172.64[.]99 conducted an automated cross-tenant password-spray campaign targeting 327 accounts across eight organizations, generating more than 151,000 failed logon events. Activity peaked October 11 at 2,900 failures per minute, with 111,000 failures in that single day across more than 2,250 tenants. On October 15 the agents obtained identities of multiple ConnectWise cloud applications and used them to authenticate into customer environments.
"Agents are not constrained by factors affecting humans," Microsoft wrote; they can "work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously." The company said the ARTEX activity let Storm-0940 "authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in."
Zscaler ThreatLabz researcher Seongsu Park reported ARTEX configurations pointing at DeepSeek, GLM, and Grok through OpenAI-compatible gateways, with prompts that "directed AI models to divide investigation tasks and review one another's findings." Recorded Future's Insikt Group is tracking a related Chinese-speaking cluster that has gone after South Korean banks as TAG-217. The campaign has run since September 2026 against tenants in aerospace, defense, energy, government, semiconductor, software, and think tanks. It lands on a busy day for our cybersecurity tracker.
What others are reporting
-
Microsoft Security Blog Read →
First-party attribution with exclusive telemetry: 151,000+ failed logons, 2,900/min peak on Oct 11, Graph API reconnaissance details, and post-compromise credential manipulation tactics across 2,250+ tenants.
Several of these Storm-0940 ARTEX-driven attacks resulted in privileged access in under 3 hours.
-
BleepingComputer Read →
Synthesizes Huntress, Todyl, and Microsoft findings into actionable IOCs: seven malicious app IDs, curl/python user agents, and confirmation attackers reached Global Admin on roughly 50 monitored tenants.
The attacker authenticated directly to Microsoft 365 as the backup application using its secret, gaining the permissions customers had already granted it.
-
The Record Read →
Connects the ConnectWise campaign to Storm-0940's earlier ARTEX attacks on South Korean and Japanese financial institutions, placing this within a global, multi-sector exploitation pattern.
Agents are not constrained by factors affecting humans — they can work around the clock, on weekends, and on holidays
-
CyberScoop Read →
Adds Microsoft VP Igor Tsyganskiy's public statement that ConnectWise is just one of many active ARTEX intrusions; maps targeted sectors including aerospace, defense, energy, financials, and government.
Storm-0940 used ARTEX to reach more than 2,250 tenants at 2,900 sign-in attempts per minute
-
The Register Read →
Frames this as ConnectWise's second nation-state compromise in 18 months, citing the May 2025 ScreenConnect incident as the prior case and raising questions about the vendor's chronic security posture.
AI agents did the dirty work, with hackers gaining privileged access in some environments in under three hours
Originally reported by thehackernews.com
Read the original article →Original headline: Microsoft Ties Storm-0940 to ARTEX-Driven ConnectWise Supply-Chain Compromise Across 2,250 M365 Tenants