Overview
- Microsoft published a technical report on Oct. 21 attributing the ConnectWise Cloud Backup compromise to a China‑aligned group tracked as Storm‑0940 and saying the group automated operations with the ARTEX agentic AI framework.
- Microsoft observed a four‑day automated password‑spray campaign between Oct. 10–14 that hit 327 accounts and produced more than 151,000 failed logons, peaking at about 2,900 failures per minute.
- On Oct. 15–16 Storm‑0940 exploited ConnectWise’s Cloud Backup environment to steal OAuth/application identities and then used those credentials to attempt sign‑ins to more than 2,250 Microsoft 365 tenants at roughly 2,900 attempts per minute.
- In multiple victim environments the AI agents moved beyond sign‑in to run Microsoft Graph reconnaissance, modify application credentials to establish persistence, and change identities, groups and privileged roles, which can leave backdoors even after the original connection is revoked.
- ARTEX was made closed‑source after misuse but copies and forks have spread, security teams should keep affected ConnectWise connections disabled, preserve app connections for forensics and audit service principal credential additions and OAuth app permissions since early October.