Overview
- Microsoft published its findings on Wednesday, Oct. 21, saying the group it tracks as Storm-0940 used the ARTEX framework to run a sprawling campaign that touched thousands of tenants.
- ARTEX is an AI‑configurable penetration‑testing tool that Microsoft says automated reconnaissance, exploitation and credential abuse by targeting OAuth applications and non-human service principals.
- The attackers exploited a ConnectWise supply‑chain compromise on Oct. 15–16 to push high-volume authentication attempts that peaked at about 2,900 sign-ins per minute and reached more than 2,250 tenants.
- In multiple incidents the operation moved from initial access to elevated cloud privileges in under three hours, and Microsoft found evidence that the actors established persistent, high‑level access in many environments.
- Microsoft has published detections and guidance to defenders, including auditing third‑party OAuth permissions, monitoring service‑principal sign-ins for sudden spikes, and deploying Defender indicators as organizations harden cloud multi‑tenant controls.