As reported by SecurityAffairs, Microsoft has formally attributed the ConnectWise Cloud Backup supply chain compromise to Storm-0940, a China-aligned threat group that weaponized an open-source AI penetration testing framework called ARTEX to target 2,250 Microsoft 365 tenants at machine speed.

Threat Intelligence: As reported by SecurityAffairs, Microsoft has formally attributed the ConnectWise Cloud Backup supply chain compromise to Storm-0940, a China-aligned threat group that weaponized an open-source AI penetration testing framework called ARTEX to target 2,250 Microsoft 365 tenants at machine speed.

This development represents a significant inflection point in the offensive AI landscape. While threat actors have experimented with LLM-assisted social engineering and AI-generated phishing for over a year, ARTEX is something qualitatively different — an autonomous, AI-orchestrated framework capable of conducting credential abuse, OAuth manipulation, and lateral movement across cloud infrastructure without sustained human intervention. The fact that it is open-source and freely available lowers the barrier for any sufficiently motivated actor to replicate this playbook.

What Makes This Operation Different

The most operationally significant metric in Microsoft's report isn't the volume of targets — though 2,250 tenants is substantial — but the time-to-privilege. Microsoft documented multiple instances where the interval between initial targeting and achieving privileged cloud access was under three hours. That is not human-operated pacing. That is machine-speed execution against live infrastructure, combining reconnaissance, credential validation, and OAuth application abuse in a continuous, automated loop.

The attack progression reveals a sophisticated adaptive strategy:

  • Phase 1 (Oct 10–14): Conventional password spraying from a single IP (144.172.64[.]99), generating over 151,000 failed authentications against 327 accounts — this phase failed to produce credentials but likely served reconnaissance purposes
  • Phase 2 (Oct 15+): Immediate pivot to stolen ConnectWise application credentials, bypassing interactive sign-in entirely by leveraging pre-authorized OAuth application tokens

The shift from failed password spraying to successful application-credential abuse — occurring the very day the ConnectWise breach became public — demonstrates that the AI agents were designed to adaptively select the highest-probability attack vector rather than persistently hammer a single method. This is the hallmark of AI-driven decision-making in offensive operations.

Why OAuth Application Abuse Is the Real Story

The core vulnerability exploited here isn't a CVE — it's architectural. Storm-0940 used pre-authorized application credentials stolen from ConnectWise's multi-tenant platform to authenticate into customer Microsoft 365 environments without triggering interactive sign-in prompts. This means:

Multi-factor authentication — the cornerstone of most modern access control programs — was structurally irrelevant in this attack path. The applications had already been granted consent and held valid tokens. No user was prompted. No MFA challenge was issued. The AI agents simply authenticated as the application.

This is the class of attack that organizations least understand and least defend against. Security teams have invested heavily in user MFA, conditional access, and identity protection — but application-level authentication operates through a parallel trust model that many visibility tools don't adequately monitor.

Who Is at Risk

Any organization using ConnectWise Cloud Backup — or any multi-tenant SaaS application that holds delegated OAuth permissions into Microsoft 365 or Azure AD — is in the expanded blast radius of this attack pattern. The sectors specifically observed in Storm-0940 targeting included aerospace, defense, energy, financial services, government, and manufacturing. However, the methodology is sector-agnostic and will be replicated by other actors.

Shield53 Recommendations

Immediate Actions

Who Is at Risk
Audit all delegated application permissions in Microsoft Entra ID (formerly Azure AD). Identify every application — particularly those from third-party vendors like ConnectWise — that holds Graph API permissions such as Mail.Read, Directory.Read.All, or Files.ReadWrite.All
Revoke and rotate application secrets and certificates for any ConnectWise-integrated applications. Assume the credentials are compromised until proven otherwise
Review audit logs in Microsoft Purview / Entra ID for non-interactive sign-ins from unknown service principals during October 10–22, 2026. Filter for SignInEventType = Non-interactive
Block the known infrastructure: Add 144.172.64[.]99 to firewall and proxy block lists; hunt for any historical authentication events from this IP

Strategic Hardening

  • Implement conditional access policies for workload identities — not just user identities. Enforce location, risk, and compliance checks on service principal sign-ins
  • Adopt least-privilege OAuth scopes for all third-party integrations. Demand justification for any application requesting directory-level or tenant-wide permissions
  • Deploy continuous monitoring of non-interactive sign-in patterns — anomalous API call volumes, new geographies, or off-hours activity from service principals should generate immediate alerts
  • Establish a third-party SaaS inventory and trust review process — every application with delegated access into your identity tenant should undergo periodic re-assessment, especially those with multi-tenant architectures where a single vendor compromise cascades to all downstream customers

The ARTEX framework's open-source availability means this is not a one-time threat to be patched and forgotten. It is a durable capability shift. Defenders must assume that AI-accelerated, adaptive cloud intrusion attempts will become the baseline — not the exception — over the next 12–18 months. Security programs that rely on human-speed detection and response will be structurally outmatched.