Overview
- Microsoft published findings on October 21 that link the ConnectWise Cloud Backup compromise to a China‑aligned group tracked as Storm‑0940 and to widespread use of the agentic AI framework ARTEX.
- Research shows Storm‑0940 used ARTEX to automate reconnaissance, large‑scale password spraying and OAuth application abuse, reaching more than 2,250 downstream Microsoft 365 tenants at rates that peaked near 2,900 sign‑in attempts per minute.
- The campaign began with automated password‑spray activity from October 10–14 and then exploited ConnectWise application identities on October 15–16 to authenticate into customer environments and in some cases gain persistent elevated cloud privileges in under three hours.
- ConnectWise paused affected services, began phased restorations this week, and Microsoft urged customers to audit third‑party OAuth app permissions, monitor service‑principal sign‑ins, and investigate unexpected application credential changes.
- Microsoft warned multiple actors are weaponizing ARTEX after its July release and later move to closed‑source, raising broader supply‑chain risk because one abused app identity can give attackers access to many customers.