China's Storm-0940 Uses ARTEX AI to Breach ConnectWise and Target 2,250 Microsoft 365 Tenants

ARTEX (Agentic Reconnaissance and Target Exploitation eXtension) is an open-source AI-assisted penetration testing framework developed in China and publicly released on GitHub. Unlike traditional automated scanning tools that execute fixed playbooks, ARTEX uses large language models as reasoning engines: it submits API queries, parses responses to identify accessible resources and permissions, generates context-aware follow-on requests, and prioritizes targets by privilege level, all without human direction.

In the Storm-0940 campaign, Microsoft observed ARTEX operating against Microsoft Graph API endpoints at rates exceeding 2,900 requests per minute. That throughput enabled Storm-0940 to enumerate tenant directories, service principals, application registrations, role assignments, and privileged accounts across thousands of organizations in the time a human analyst might survey a single tenant. The AI layer allowed ARTEX to identify when an application credential granted cross-tenant access, immediately pivoting to enumerate those resources before moving to the next available entry point.

The ConnectWise campaign marks the first confirmed nation-state deployment of an agentic AI tool at supply chain scale. CrowdStrike had documented earlier ARTEX use in targeted attacks against South Korean financial institutions, but those incidents involved human-in-the-loop AI assistance rather than autonomous operation. The key operational shift is that ARTEX's LLM-backed reasoning layer identifies exploitable permission chains that simpler tools skip: for example, an application with GroupMember.Read.All that also has hidden write access through delegated grants. Traditional rate-limiting controls designed for human-speed reconnaissance underestimate ARTEX-style attack velocity by orders of magnitude.

ConnectWise Cloud Backup is a multi-tenant SaaS application used by managed service providers and enterprise IT teams to manage Microsoft 365 backup operations across their entire customer base. Its multi-tenant architecture requires it to hold application credentials with broad Microsoft Graph API access, including permissions to read directory objects, list service principals, and in many configurations, access user content across every enrolled tenant.

Storm-0940 obtained these application credentials during its October 10-14 password spray campaign against ConnectWise's authentication systems. With those credentials, the group gained access to a multi-tenant application context that is not scoped to a single organization's M365 environment but operates across all customers enrolled in the ConnectWise service. This is the supply chain risk: compromising a single SaaS vendor's application credentials does not expose one organization; it exposes every customer of that vendor.

Microsoft explicitly confirmed that this attack "did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services." The attack surface is the trusted third-party application layer, specifically the permissions granted to multi-tenant SaaS integrations and the implicit trust those integrations inherit from their entire customer base. ConnectWise has not published a CVE or patch because this was a credential-based intrusion rather than a software exploit. Organizations should treat any ConnectWise application permission grant as potentially exposed and revoke or re-issue all associated credentials with explicit re-authorization from IT leadership after October 21, 2026.

Internal links: organizations managing cloud backup risk should also review LiteLLM 1.107.0 supply chain attack analysis and MSP supply chain exploit patterns via N-central CVE-2026-18577.

The Storm-0940 ARTEX campaign is the largest confirmed AI-accelerated cloud intrusion on record by victim count. Microsoft's investigation covers activity from September through October 2026.

Targeted sectors include technology, financial services, healthcare, and critical infrastructure, consistent with Storm-0940's historical collection priorities. Microsoft has not published a full sector breakdown but states activity spanned "a broad range of industries."

The privileged access achieved by Storm-0940 enables credential harvesting at scale. Once an attacker has write access to application credentials and role assignments in a tenant, they can create persistence through new service principals, modify existing application secrets to enable future access without the original compromised credential, and export mailbox and OneDrive content through the Graph API without triggering traditional sign-in anomaly alerts. The sub-3-hour timeline from initial targeting to privileged access is the most operationally significant finding: threat detection playbooks for OAuth abuse that assume days of attacker dwell time will fail against an actor operating at this speed.

Storm-0940 is a China state-aligned threat actor that Microsoft has tracked since at least 2021. The group focuses on intelligence collection targeting government agencies, defense contractors, technology companies, and critical infrastructure in the United States and allied nations. Microsoft assesses Storm-0940 operates in support of Chinese state intelligence objectives, with a demonstrated preference for credential theft and cloud identity compromise over traditional malware-based intrusions.

Prior to the ConnectWise campaign, Storm-0940 was known primarily for password-spraying Microsoft 365 environments, typically targeting Exchange Online accounts at technology companies and government-affiliated research organizations. The October 2026 operation represents a significant evolution in tradecraft: instead of targeting individual accounts sequentially, Storm-0940 compromised the SaaS supply chain layer to achieve lateral scale, then used ARTEX to exploit that scale at machine speed.

MITRE ATT&CK Techniques Observed:

Storm-0940 is assessed to be intelligence-motivated. No ransomware or financial extortion has been attributed to this group. The likely collection objectives include M365 mailbox content, SharePoint documents, and service principal credentials that could enable persistent access to downstream government or defense networks.

Block these IPs at your perimeter firewall and cloud network controls immediately. Review all AADServicePrincipalSignInLogs and AuditLogs for activity from 144.172.64.0/24 between October 10-24, 2026.

These rules detect two attack phases: high-frequency Graph API enumeration characteristic of ARTEX's AI-driven reconnaissance, and suspicious OAuth application credential rotation used for post-compromise persistence. Both carry experimental status; validate rule thresholds against your environment's normal Graph API traffic volume before enabling automatic blocking. The rate threshold in Rule 1 (100 reads per minute per application) should be tuned to your environment's baseline for legitimate SaaS application activity.

Every organization using ConnectWise Cloud Backup or any multi-tenant MSP SaaS integration with Microsoft 365 should complete all seven steps within the next 24 hours. Steps 1-3 are blocking and detection; steps 4-7 are credential remediation and preventive hardening.

The Storm-0940 ARTEX campaign challenges two assumptions that most cloud security programs are built on: that attackers operate at human speed and that supply chain risk is limited to software artifacts.

Traditional cloud anomaly detection is calibrated for human-speed reconnaissance. Anomalous sign-in patterns, unusual Graph API access volumes, and suspicious application credential changes are designed to alert after days of attacker dwell time, when the behavior has accumulated enough signal to cross detection thresholds. An attacker completing full tenant enumeration and privilege escalation in under three hours never reaches those thresholds. ARTEX's 2,900 requests-per-minute operating tempo means that by the time a daily anomaly detection sweep identifies suspicious Graph API activity, the attacker has already established persistence and may have exfiltrated target content.

The supply chain dimension extends this problem. Security teams have invested heavily in software supply chain controls: dependency scanning, signed packages, SBOM verification. SaaS supply chain risk, the trust granted to third-party multi-tenant applications, receives far less scrutiny. Every organization that has granted a SaaS vendor's application Directory.Read.All or equivalent permissions is one compromised vendor credential away from the same cross-tenant exposure ConnectWise experienced. The ConnectWise breach demonstrates that MSP tooling represents an extraordinarily high-leverage attack surface: a single vendor compromise provides simultaneous access to every customer tenant that has enrolled in the service.

The defensive response requires tuning detection for machine-speed adversaries, applying least-privilege principles to all third-party SaaS application grants, and building continuous SaaS supply chain visibility comparable to the software supply chain controls organizations already operate. Review your OAuth app grant inventory against the LiteLLM supply chain analysis for the broader SaaS supply chain risk context.