Storm-0940 / ARTEX AI-driven supply-chain attack: ConnectWise Cloud Backup — China-aligned actor compromised M365 tenants via AI-automated password spraying and OAuth abuse
Severity: high · Patch status: no-fix-needed · Since 2026-10-21
Microsoft attributed a supply-chain attack on ConnectWise Cloud Backup customers' Microsoft 365 environments to China-state-aligned threat actor Storm-0940, active since 2021. As early as September 2026 the group used ARTEX, an open-source LLM-driven agentic penetration-testing framework, to automate reconnaissance, password spraying and OAuth abuse. After a four-day campaign (ending Oct 14) against 327 M365/Exchange Online accounts across eight organizations with 151,000+ failed logons peaking at 2,900/minute, Storm-0940 compromised ConnectWise Cloud Backup the next day, reaching 2,250+ tenants. AI agents performed directory reconnaissance, modified application credentials for persistence, and altered identities, groups and privileged roles; multiple environments showed follow-on activity. ConnectWise shut down services Oct 17 and began phased restoration Oct 21; recovery expected to take days. Number of compromised customers undisclosed.
What to do
- Review Microsoft 365 audit logs for anomalous sign-ins, OAuth application consent, and application credential modifications since early October 2026
- Rotate credentials and re-authorize or remove suspicious OAuth/enterprise applications, especially those tied to ConnectWise Cloud Backup
- Keep ConnectWise Cloud Backup connections disabled per vendor guidance until phased restoration completes and integrity is confirmed
- Harden against password spraying: enforce MFA, conditional access, and rate-limit/lockout monitoring at scale
- Monitor Microsoft Graph and directory operations for persistence mechanisms, privileged role changes, and backdoor creation
- Track Microsoft Threat Intelligence guidance on ARTEX-based agentic attack activity
Sources
All live incidents on Threat Watch
