Storm-0940 Turns Stolen ConnectWise App Credentials and an AI Framework on 2,250+ Microsoft 365 Tenants

A China-linked threat actor tracked by Microsoft as Storm-0940 used ARTEX, an AI-driven penetration-testing framework, to push into more than 2,250 Microsoft 365 tenants in the wake of the ConnectWise Cloud Backup breach. The striking part isn't a new exploit — there isn't one. It's speed: automation let the operators move from stolen credentials to privileged cloud access in under three hours in several cases.

What happened

The attackers didn't need anyone's password. They used application credentials stolen from ConnectWise and the permissions customers had already granted to ConnectWise's integrations (Cloud Backup, MS Teams and MS Graph apps). Signing in as those trusted apps meant no interactive login, no MFA prompt and nothing for a user to notice.

The numbers show how automated this was:

• 2,250+ tenants reached through app-only sign-ins
• ~2,900 sign-in attempts per minute at peak
• 200+ sign-ins in under four minutes using just four application credentials

Earlier tallies counted confirmed unauthorized sign-ins in 173 tenants. The gap between the two figures matters: not every attempt succeeded, and a successful sign-in on its own does not prove that data was taken.

Once inside, the attackers used Microsoft Graph to look around each environment and to add or change application credentials. Some activity touched users, groups and privileged roles — changes that can keep a foothold alive through other applications even after the ConnectWise connection is switched off.

Separately, between 10 and 14 October the same actor's infrastructure ran a password-spray campaign against 327 accounts at eight organisations, generating more than 151,000 failed logons. Microsoft saw no successful authentication from that spray.

Microsoft states the activity did not come from a vulnerability or compromise in its own products or services.

The AI angle

ARTEX is a legitimate-looking security-testing framework, not a new malware family. Zscaler ThreatLabz examined how a Chinese-speaking operator wired it to AI coding workspaces such as Claude Code and Codex: the framework split goals into tasks, ran tools such as nmap, sqlmap and nuclei (plus Android analysis tooling), and kept a shared memory of findings so separate AI sessions could pick up unfinished work. Configurations referenced several models, including DeepSeek, GLM and Grok — though Zscaler cautions that a configured model name doesn't prove which model actually answered. Notably, the operator instructed the agents to assume targets were authorized and relaxed approval steps.

Two caveats worth keeping: Zscaler's research and Microsoft's ConnectWise investigation have not been shown to describe the same actor, and saved prompts asking about selling stolen records suggest a financial motive without establishing that any sale happened.

Why it matters

This is the supply-chain problem in its cloud form. A vendor integration you approved once becomes a standing, MFA-free door into your tenant — and when it's abused at machine speed, the window between first access and privilege escalation shrinks to hours. AI tooling doesn't invent new techniques here; it removes the human bottleneck from old ones.

What to do

1. Keep affected ConnectWise connections disabled until the vendor issues formal restoration guidance.
2. Preserve evidence first. Export logs before deleting applications or service principals.
3. Review service-principal activity: sign-ins, newly added app secrets/certificates, consent grants and role assignments since early October.
4. Look beyond ConnectWise. Audit every previously authorized integration — attacker-added credentials may live on a different app.
5. Hunt past the IoC list: unusual Graph queries, mailbox access, bulk file downloads, new forwarding rules and unexpected app or group owners.
6. Tighten consent: limit who can grant application permissions, prune unused apps, and alert on credential changes to service principals.

Stolen app secrets and tokens like these often surface in criminal channels before they're used at scale. Our team's Deep/Dark Web monitoring watches for exactly that kind of exposure — leaked credentials and secrets tied to your organisation and its suppliers — so you can rotate them before someone automates the rest.

Indicators of compromise

Defanged — re-fang only inside your SIEM or threat-intel platform.

Source: Cyber Security News. Original research by Microsoft Threat Intelligence and Zscaler ThreatLabz.