Microsoft has attributed a ConnectWise Cloud Backup supply-chain intrusion and related Microsoft 365 targeting to Storm-0940, a China-state-aligned hacking group active since 2021. The operation targeted more than 2,250 Microsoft 365 tenants using stolen ConnectWise application credentials, as first reported by Tom’s Hardware.
The group used ARTEX, a Go-based framework built around autonomous large language model agents, to automate penetration-testing tasks. Microsoft said the tool can handle scanning, reconnaissance, password spraying and OAuth application abuse. The company said its own systems, products and services were not compromised or vulnerable in this incident.
Automated attacks moved quickly toward privileged accounts
Storm-0940 used four application credentials to make more than 200 sign-ins in four minutes from the same IP range. In some environments, the activity reached privileged access in less than three hours after targeting began. Investigators observed directory and Microsoft Graph reconnaissance, changes to application credentials, and modifications affecting identities, groups and privileged roles.
On October 11, password spraying against 327 accounts at eight organizations peaked at roughly 2,900 attempts per minute. The effort produced more than 151,000 failed logins, with account lockouts blocking nearly 98% of attempts. On October 15, Huntress observed an application grant itself the Global Administrator role and create secrets set to expire in 2028.
Supplier credentials can extend an attack across customer tenants
ConnectWise operates a multi-tenant technology platform, and its application credentials can authenticate software across customer environments without an interactive user sign-in. That made the stolen credentials especially valuable: one supplier-side access path could expose Microsoft 365 tenants in aerospace and defense, semiconductors, government and think tanks. AI-driven automation also lets operators perform repetitive attack steps at a pace that can strain detection and response teams.
Microsoft has not disclosed how Storm-0940 obtained the ConnectWise credentials, how many of the targeted tenants were actually compromised, or how many organizations suffered data access or lasting persistence. The campaign’s full duration and scope also remain unclear. Reports differ on whether ARTEX remains open source after alleged abuse against South Korean financial institutions.
This article was produced with AI assistance from multi-source reporting and is published under our editorial standards.
