More than 2,250 Microsoft 365 tenants were probed using compromised ConnectWise application credentials and AI-driven automation, Microsoft says — a campaign that in some cases moved from target selection to privileged cloud access in under three hours.
Storm-0940 and ARTEX: China-linked actors using AI agents
Microsoft traced the activity to a group it tracks as Storm-0940, which the company describes as China‑linked and whose operations date back to at least 2021. Unlike earlier campaigns that relied on traditional techniques such as password spraying and exploiting internet-facing applications, Microsoft says Storm-0940 began using an open source AI penetration‑testing tool called ARTEX to automate large parts of its attacks.
ARTEX is an open source penetration‑testing framework written in Go that uses AI agents to automate tasks ranging from reconnaissance and vulnerability discovery to credential attacks and data theft. Microsoft says Storm-0940 began employing ARTEX as early as September to target organizations worldwide, including government agencies, defense contractors, banks, manufacturers, and technology firms.
How ConnectWise application credentials were abused
The intrusion tied back to compromised ConnectWise application identities. Those application credentials allowed attackers to exercise permissions customers had already granted to ConnectWise services — without requiring an interactive user login. ConnectWise reacted by pulling the plug on its Cloud Backup, SaaS Security, and Cloud Management services after discovering unauthorized access to application identities.
ConnectWise CEO Manny Rivelo said the company had contained the affected application connections and was gradually restoring services, although shutting down those connections "wouldn't necessarily boot out attackers who had already established a foothold in customer environments," according to Microsoft’s account of the company statement.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleScale, speed and the pattern of observed activity
The campaign mixed traditional credential abuse with AI-accelerated operations. Between October 10 and 14, Microsoft recorded more than 151,000 failed sign-in attempts directed at 327 accounts across eight organizations; Microsoft observed no successful logins from that particular password‑spraying effort. Afterward, attackers shifted to using the compromised ConnectWise application identities, attempting to authenticate against more than 2,250 Microsoft 365 tenants and at times reaching 2,900 attempts per minute.
Microsoft also observed AI‑accelerated activity through Microsoft Graph that included reconnaissance, application credential changes, and attempts to modify privileges — actions that could enable attackers to persist inside environments even after the original credentials were revoked. While most attempts failed, Microsoft says the threat actors still managed to establish persistent privileged access at numerous organizations. The company has not disclosed how many customers were compromised or whether any data was stolen, cautioning that a successful login "doesn't necessarily mean information was accessed."
ARTEX as a dual‑use tool and the wider actor landscape
Microsoft emphasized that Storm-0940 is not the only actor using ARTEX. The framework's public availability means attackers from several geographic regions have been observed employing it. Microsoft framed the underlying techniques as familiar — stolen credentials, password spraying, and application abuse — but said AI helped Storm-0940 execute those techniques faster, reducing the time from initial targeting to privileged access in some cases to under three hours.
What this means for Microsoft 365 security teams, ConnectWise customers, and ARTEX maintainers
- Microsoft 365 security teams should be alert to AI‑accelerated activity patterns Microsoft observed: high‑rate authentication attempts, Microsoft Graph calls that change application credentials or privileges, and indicators of persistent privilege creation.
- ConnectWise customers will need to assume that cutting affected application connections may not by itself expel a determined intruder; Microsoft reported that attackers could persist after credentials were revoked, and ConnectWise acknowledged that shutting connections "wouldn't necessarily boot out attackers" once a foothold existed.
- Maintainers and users of ARTEX face a classic dual‑use dilemma: Microsoft found the framework in the hands of multiple actors. Its availability has enabled automation of reconnaissance and credential attacks, and that diffusion will shape how defenders and vendors prioritize controls and guidance around machine‑assisted penetration tools.
Microsoft’s findings place a spotlight on a recurring vector: trusted third‑party application permissions. The company’s account confirms the breach involved a trusted vendor’s application identities, large‑scale automated authentication attempts, and AI‑assisted reconnaissance and privilege changes — but it also leaves the extent of customer compromise and data impact unspecified. As ConnectWise works to restore services and Microsoft continues its analysis, the central question remains: how many tenants will find that the permissions granted to a vendor proved an easy avenue for persistent access?
