The attacker who took over a ConnectWise backup application's identity and used it to walk into Microsoft 365 tenants last week was a China-state aligned group, and it let AI agents do much of the work. Microsoft Threat Intelligence assesses that the actor it tracks as Storm-0940 was responsible for the ConnectWise supply chain compromise, and that it used ARTEX, an open-source agentic AI penetration testing framework, to run the operation at machine speed.
The scale is the story. After acquiring control of multiple ConnectWise cloud application identities, Storm-0940 used ARTEX to reach more than 2,250 tenants at 2,900 sign-in attempts per minute, according to Microsoft. In multiple attacks, the time from first targeting an organization to holding privileged access to its cloud infrastructure was under three hours.
A known data-theft crew, now automated
Microsoft says Storm-0940 has been active since 2021, has no known industry aliases, and targets organizations across many industries for data theft. Its usual playbook is password spraying and exploiting internet-facing applications, then persisting in the cloud by adding credentials to existing OAuth applications and pulling mail and other data through Microsoft Graph. What changed is the pace. As early as September 2026 the group was using ARTEX to automate attacks on hundreds of organizations worldwide, in sectors including aerospace and defense, energy, financial services, government, legal, semiconductors and think tanks.
ARTEX is a multi-agent system written in Go that drives an AI model through a penetration test from reconnaissance to exfiltration with little human input. It was first tied to breaches at South Korean financial institutions, and Microsoft says threat actors in multiple regions now use it.
The password spray came first
Microsoft's timeline extends what Huntress first documented. Between October 10 and 14, Storm-0940 infrastructure at 144[.]172[.]64[.]99 sprayed 327 accounts across eight organizations, producing more than 151,000 failed logons and no successful authentication. On October 15, reports of the ConnectWise compromise surfaced with indicators in the same 144[.]172[.]64[.]x range, and an address the vendor shared on October 16 matched the spraying host exactly.
With the app identities, the agents signed in to customer tenants through applications that already had access, so no user sign-in was needed. In several environments Microsoft saw AI-accelerated follow-on activity through Graph: reconnaissance, application credential changes, and changes to identities, groups and privileged roles. Those credential changes can survive as a backdoor after the ConnectWise app itself is remediated. Microsoft stresses that the activity did not stem from any compromise of its own systems, and that an affected app, or even a successful sign-in, does not necessarily mean data was accessed or exfiltrated.
Keep the apps disabled and hunt back to October 1
- Leave affected ConnectWise connections disabled until ConnectWise issues restoration instructions, and preserve evidence before deleting anything.
- Search every tenant by application ID, not display name: 506e08f9-6e9a-4da4-942b-a099a03644ae (Cloud Backup), 24205314-2b89-4e07-a2a4-579e898a5640 (MS Teams), 0de14c77-b9b0-4137-9360-34878a929827 (MS Graph) and c921256f-04a7-44e8-9b2a-69c33929ba19 (SkyKick Partner Portal).
- Review service principal sign-ins from October 15, and from October 1 where logs allow, without limiting the search to published IPs.
- Audit Entra for new app credentials, owners, consent grants and privileged role assignments, then check for unusual mail access, forwarding and inbox rules.
Not the only crew wiring AI into intrusions
Separately, Zscaler ThreatLabz researcher Seongsu Park examined the workspace of the financially motivated, Chinese-speaking operator behind the South Korean bank intrusions. Prompt histories from August 4 to October 4 show ARTEX run alongside Claude Code, Codex and Grok workspaces, with DeepSeek doing the first pass on a target and GLM told to review DeepSeek's work for gaps. Targets referenced spanned 19 countries and territories. Microsoft does not link that operator to Storm-0940.
Indicators
- 144[.]172[.]64[.]99, 144[.]172[.]64[.]128, 144[.]172[.]64[.]60: sign-ins and Graph activity via ConnectWise apps
- 187[.]15[.]88[.]186, 187[.]15[.]90[.]217, 187[.]15[.]89[.]186: transient VPN addresses, relevant for October 15 and 16
- User-Agents: Python-urllib/3.12, python-requests/2.31.0, python-requests/2.34.2, curl/7.88.1, azure-toolkit/1.0
Storm-0940 needed no new exploit. It reused a technique it has leaned on for years and let software run it across thousands of tenants faster than a human team could triage the alerts. A trusted vendor app with broad permissions can now be worked at machine speed, and response plans that assume hours of warning need revisiting.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.