Microsoft has disclosed that a state-aligned threat actor operating out of China, tracked under the moniker Storm-0940, orchestrated the recent supply chain compromise affecting the ConnectWise Cloud Backup application.
The security advisory sheds light on how modern cyber adversaries are increasingly turning to automated, agentic artificial intelligence frameworks to execute complex, multi-stage attacks at unprecedented speeds. According to Microsoft’s findings, the campaign weaponized ARTEX—a Go-based agentic AI penetration testing framework—to automate critical phases of the intrusion lifecycle, including reconnaissance, vulnerability scanning, password spraying, and downstream OAuth application abuse.
The ARTEX framework itself has a notable history within the cybersecurity landscape. Originally developed as a specialized tool, it was made closed-source following its malicious abuse in targeted attacks against South Korean financial institutions. In the hands of Storm-0940, however, the framework found a new and broader operational scope, driving automated attacks at "machine speed" against hundreds of enterprise organizations worldwide since September 2026.
The global sweep of the campaign reflects a diverse targeting strategy across a wide array of critical sectors. Organizations impacted by or targeted in the operation span aerospace and defense, automotive, chemicals, energy, financial services, government agencies, legal practices, manufacturing, media, military organizations, semiconductor manufacturing, software development, technology firms, as well as think tanks and non-profit institutions.
The operational efficiency granted by ARTEX fundamentally altered how the threat actor engaged with victim environments. Microsoft noted that Storm-0940’s integration of the AI tool dramatically accelerated the abuse of pre-existing, compromised application permissions. By leveraging applications that had already been granted authentication access within target environments, the threat actor bypassed the need for interactive user sign-ins, allowing them to maintain operational momentum under the radar.
Following initial access, the AI-driven follow-on activity moved with remarkable swiftness. Automated processes executed rapid reconnaissance, initiated application credential changes, and attempted privilege modifications designed to secure expanded and persistent access across corporate networks.
Storm-0940 is not a newcomer to the threat intelligence community. The adversary was first detailed by Microsoft in November 2024, when researchers revealed that the group had been actively leveraging a botnet known as Quad7, also tracked as CovertNetwork-1658, to execute highly evasive password-spray campaigns. Historical tracking indicates that the threat actor has been operational since at least 2021, steadily refining its tactics, techniques, and procedures.
Beyond botnet-driven password spraying, the adversary has consistently relied on exploiting internet-facing applications to secure initial footholds. Once inside a network, the group uses compromised user accounts to laterally traverse targeted environments. A favored persistence mechanism involves adding new credentials to existing OAuth infrastructure, ensuring long-term access to cloud environments such as Microsoft 365 resources.
The introduction of ARTEX into this operational matrix, however, has compressed attack timelines from days or weeks down to mere hours. Microsoft reported that a substantial portion of the ARTEX-driven attacks successfully yielded privileged access to organizational cloud infrastructures, with several instances where the transition from initial targeting to full administrative control occurred in less than three hours.
In the specific context of the ConnectWise incident, Storm-0940 leveraged ARTEX to target over 2,250 separate corporate tenants, generating a staggering volume of roughly 2,900 sign-in attempts per minute. Security analysts emphasize that this hyper-accelerated cadence leaves human defenders with an exceptionally narrow window to detect, analyze, and neutralize active threats.
Detailed telemetry from Microsoft highlights the sheer scale of the automated barrage. Between October 10 and 14, 2026, infrastructure associated with Storm-0940, specifically tracing back to the IP address 144.172.64[.]99, executed an automated cross-tenant password-spray campaign. The effort specifically targeted 327 accounts spread across eight organizations in a bid to breach Microsoft 365 and Exchange Online environments.
Over this four-day window, Microsoft captured more than 151,000 failed logon events. The activity reached its zenith on October 11, recording 2,900 failures per minute and translating to over 111,000 failed authentication attempts within a single 24-hour period. Within that cohort, 48 individual accounts absorbed more than 1,000 failures each. Notably, telemetry indicated that no successful authentications, token issuances, Graph API calls, or directory modifications occurred during this initial brute-force phase.
That tactical posture shifted dramatically on October 15, 2026. On this date, the AI agents successfully acquired the identities of multiple ConnectWise cloud applications, immediately pivoting to use those legitimate identities to authenticate directly into customer environments.
By seizing control of these trusted application identities, the threat actor continued routing traffic through the same infrastructure IP range. This allowed them to exploit the pre-established trust relationships that these applications already enjoyed within respective customer tenants, circumventing traditional perimeter defenses.
In several instances observed by researchers, the automated AI agents pushed beyond simple authentication, initiating complex interactions with Microsoft Graph and executing directory-level operations. These deep-dive activities encompassed comprehensive internal reconnaissance, application credential modifications designed to establish long-term persistence, and structural changes involving user identities, security groups, and privileged administrative roles.
Microsoft warns that the application credential modifications performed by Storm-0940’s automated agents can result in deep-seated persistence through alternative identities, secondary credentials, and adjacent cloud services. Crucially, these unauthorized modifications can persist as functional backdoors even after the initial compromised application has been remediated and isolated.
While Storm-0940 has become a prominent adopter of the technology, it is not the sole hacking collective weaponizing the framework. Microsoft confirmed that it has tracked threat actors across multiple distinct geographic regions incorporating ARTEX into their offensive security operations, underscoring a broader industry trend toward the weaponization of agentic AI.
The campaign highlights a paradigm shift in how cybercriminals and state-sponsored groups integrate advanced automation into offensive workflows. Traditional human constraints, such as the need for rest, operational downtime during weekends, and holiday schedules, no longer apply to agentic systems. These tools are capable of operating continuously around the clock, testing multiple potential breach paths simultaneously, and drastically compressing the timeline from target selection to objective realization.
Responding to the disclosures, ConnectWise emphasized that the sophisticated campaign extends far beyond the impact on any single vendor. The incident underscores a systemic vulnerability within the modern digital ecosystem, where state-sponsored entities increasingly target the software supply chain because a single compromised trusted connection can unlock access to hundreds of downstream organizations.
Managed Service Providers occupy a particularly vulnerable position within this interconnected chain, functioning simultaneously as high-value targets and direct pathways into client networks across the globe. Industry stakeholders stress that software vendors and service providers alike must adapt their security postures to account for automated attacks operating at machine speed.
Following the initial detections and subsequent service disruptions, ConnectWise temporarily shut down affected systems to contain the breach. The company has since initiated a phased restoration process, noting that bringing all services back online safely will require several days of continuous monitoring and verification.
