Microsoft ties Storm-0940 to AI-automated attacks
Microsoft's report at a glance
Microsoft has linked a China-aligned hacking group, Storm-0940, to a wave of attacks that AI agents carried out for it. The group ran ARTEX, an open-source framework built for penetration testing, and pointed it at hundreds of organizations around the world. Microsoft Threat Intelligence also pinned the recent breach of ConnectWise's cloud backup service on the same group.
None of it came through a flaw in Microsoft's own products or systems, the company says. The way in was stolen app credentials and guessed passwords, run at a pace no human team could keep.
"October 21／The activity conducted by the threat actor through the usage of ARTEX framework did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services." — Microsoft Security Blog, “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise”View official source →
Hundreds of organizations targeted since September
Storm-0940 started using ARTEX no later than September 2026. The targets span sectors with little in common:
- Aerospace, defense, military and government
- Financial services, legal, media, think tanks and nonprofits
- Automotive, chemical, energy and manufacturing
- Semiconductors, software and technology
Most of the attempts failed. Even so, the group got privileged access to cloud environments at a number of organizations, and in several cases it took less than three hours from first targeting to admin-level control.
Microsoft's explanation is simple. Agents don't sleep or take weekends off, and they can try several ways in at once, which shrinks the time between picking a target and getting what the attacker came for.
"As early as September 2026, Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries.／multiple instances where the time from initial targeting to privileged access was less than 3 hours／they can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously" — Microsoft Security Blog, “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise”View official source →
Storm-0940 has been active since 2021
Storm-0940 has been stealing data from organizations in many industries since 2021. Microsoft says it has no known aliases elsewhere in the security industry.
Its usual playbook hasn't changed. The group gets in through password spraying, which means trying a handful of common passwords against many accounts, or through apps exposed to the internet.
Once inside a cloud tenant, it adds its own credentials to an OAuth app, a third-party app the organization has already granted access to its Microsoft 365 data. That keeps its access to Microsoft 365 resources going long after the first break-in. What ARTEX changed is speed: Microsoft describes the same app abuse running at machine speed.
"Storm-0940 is a China-state aligned actor (with no known industry aliases) that has been active since 2021 and targets organizations across multiple industries for data theft.／In cloud environments, the actor has also established persistence by adding credentials to existing OAuth applications／in this case the actor used ARTEX to accelerate the activity to machine speed" — Microsoft Security Blog, “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise”View official source →
What ARTEX is: an open-source AI pentest framework
ARTEX in brief
ARTEX is an open-source framework that hands penetration testing to AI agents. Penetration testing is an authorized attempt to break into a system so its owner can find and fix the weak spots first. ARTEX was built for that defensive job, but anyone who downloads it can aim it at someone else's network instead.
It isn't tied to one AI provider. Microsoft says it can drive any model, and the agents carry a test from reconnaissance all the way to pulling data out with very little input from a person.
"ARTEX is an open-source penetration testing framework that can use any AI model to automate a variety of offensive security workflows.／ARTEX is a system of LLM-driven agents that run an autonomous penetration test from reconnaissance through data exfiltration with little needed human interaction." — Microsoft Security Blog, “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise”View official source →
Multiple AI agents split the work
Inside ARTEX, several LLM agents each take a stage of the job. The core is written in Go, and the dashboard is a Next.js web app.
The interface starts in English and can be switched to Korean, Mandarin, Spanish or Japanese. Because the project is public, defenders and intruders download exactly the same thing.
"The ARTEX framework is a multi-agent LLM system written in GO with a Next.js frontend.／While the UI and generated output default to English, the framework can be switched to Korean, Mandarin, Spanish, or Japanese." — Microsoft Security Blog, “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise”View official source →
Other groups are using ARTEX too
Storm-0940 is not the only group running ARTEX. In October 2026 the framework turned up in reporting on data breaches at South Korean financial institutions, a separate case we covered in AI hacking hit Korean banks: what is confirmed.
Microsoft says it has seen threat actors in several regions of the world using the framework. Blocking one group's servers won't make the tool go away.
"In October 2026, public reporting noted that the ARTEX framework was being used by threat actors, such as the personal data breaches targeting Korean financial institutions.／Microsoft Threat Intelligence has identified threat actors across multiple geographic regions leveraging the ARTEX framework." — Microsoft Security Blog, “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise”View official source →
How the ConnectWise compromise reached 2,250 tenants
Timeline of the ConnectWise path
| Date | What happened |
|---|---|
| October 10–14 | Password spray against 327 accounts at eight organizations, with no successful sign-ins |
| October 15 | Public reports of the ConnectWise compromise, with indicators from the same IP range |
| October 16 | ConnectWise publishes its first advisory |
| October 21 | Microsoft ties Storm-0940 and ARTEX to the activity |
After getting into ConnectWise's cloud backup environment, Storm-0940 used ARTEX to try signing in to more than 2,250 Microsoft 365 tenants. A tenant is an organization's own space in Microsoft 365, holding its users, mail and files. ConnectWise put out its first advisory about unauthorized access to Cloud Backup on October 16.
The tenants belonged to ConnectWise's downstream customers, the organizations that had connected its apps to their Microsoft 365. Against them, ARTEX sped up scanning, password spraying and app abuse together.
"ConnectWise published an initial advisory on October 16, 2026／Following the unauthorized access, Storm-0940 used ARTEX to attempt to sign-in to more than 2,250 tenants." — Microsoft Security Blog, “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise”View official source →
A password spray against 327 accounts failed
From October 10 to 14, infrastructure tied to Storm-0940 ran an automated password spray against 327 accounts at eight organizations. Microsoft logged more than 151,000 failed sign-ins over those days.
Failures peaked on October 11 at 2,900 a minute, with more than 111,000 in a single day. Forty-eight accounts saw over 1,000 failures each, and nearly 98% of the responses were lockouts, so none of these attempts got in.
Several write-ups describe 2,900 per minute as the rate of sign-ins against the 2,250 tenants. In Microsoft's report, it is the peak of failed logons in this earlier spray.
"Between October 10 and 14, 2026, Storm-0940 infrastructure at 144.172.64[.]99 conducted an automated cross-tenant password-spray campaign targeting 327 accounts across eight organizations／Microsoft telemetry captured 151,000+ failed logon events, with activity peaking on October 11 at 2,900 failures per minute and concentrating more than 111,000 failures into a single day／48 accounts received more than 1,000 failures, and lockout responses represented nearly 98% of all activity／Despite the scale, no successful authentication, token issuance, Graph call, or directory change was observed." — Microsoft Security Blog, “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise”View official source →
A trusted app let the group skip user sign-in
The tenants that mattered were the ones where ConnectWise's apps already had consent to reach Microsoft 365 data. Storm-0940 took the credentials for those apps and signed in as the apps themselves.
An app sign-in needs no employee to type a password, so there was no user to prompt for MFA. The affected apps include ConnectWise Cloud Backup along with apps tied to Teams and Microsoft Graph.
When the ConnectWise breach became public on October 15, its indicators came from the same network range used in the password spray. That match is how Microsoft connected the breach to Storm-0940.
"authenticate to Microsoft 365 customer environments through applications that had already been granted access.／This allowed the threat actor to operate without requiring an interactive user sign-in.／public reports of the compromise of the popular cloud backup application ConnectWise started to surface with direct references to indicators of compromise matching the same network range observed for the earlier password-spray campaign" — Microsoft Security Blog, “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise”View official source →
Privileged access in under three hours
In several organizations, Storm-0940 went from first targeting to privileged cloud access in less than three hours. Inside, the agents queried Microsoft Graph and changed app credentials. They also altered identities, groups and privileged roles.
Credentials added to other apps can stay behind as a backdoor even after the original ConnectWise app is fixed. Microsoft notes that AI-driven activity is noisy and can set off alerts, but it moves fast enough to leave defenders little time to respond.
"multiple instances where the time from initial targeting to privileged access was less than 3 hours／including reconnaissance, application credential modifications to establish persistence, and changes involving identities, groups, and privileged roles.／These changes can remain active as a backdoor even after the original compromised application is mediated.／When automated with AI, these activities generate a large volume of traffic and log data that may generate alerts." — Microsoft Security Blog, “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise”View official source →
What Microsoft tells affected organizations to do
Microsoft's immediate steps
| Step | What it means |
|---|---|
| Keep apps disabled | Leave the affected ConnectWise app connections off until ConnectWise publishes formal restoration steps |
| Don't delete first | Preserve configuration and evidence before any change that can't be undone |
| Search by app ID | Look up the apps by application ID, not display name, in every tenant, including unused ones |
| Look back far enough | Review activity from October 15 at minimum and service-principal sign-ins back to October 1 where logs exist |
Microsoft's first instruction to organizations with the affected ConnectWise apps is to keep them disabled and not delete them yet. Deleting an app is irreversible, so configuration and evidence come first. The apps stay off until ConnectWise publishes formal restoration steps.
Look the apps up by application ID rather than display name. Check every tenant that ever consented to them, including ones where the integration is no longer in use.
"Keep affected ConnectWise application connections disabled until ConnectWise provides formal restoration instructions.／Do not delete enterprise applications as the first response.／Search by application ID rather than display name." — Microsoft Security Blog, “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise”View official source →
Disable the apps and preserve evidence first
Before removing anything, save the Entra ID sign-in and audit logs, Purview audit records and SIEM data that cover the period. Those records are what show whether the group only signed in or went further.
Then go through the audit logs. Three kinds of change matter most:
- New credentials on apps, and new apps or owners you don't recognize
- Consent grants and privileged role assignments
- Changes to users, groups, authentication methods and Conditional Access
Mail and file access, downloads and forwarding rules belong in the same review. So do inbox and transport rules and delegated mailbox permissions.
"Preserve configuration and evidence before making irreversible changes／Preserve available Microsoft Entra sign-in and audit records, Microsoft Purview Audit records, SIEM data／Review Microsoft 365 audit records for unusual mail or file access, downloads, forwarding, inbox or transport rules, delegated mailbox permissions" — Microsoft Security Blog, “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise”View official source →
Review sign-ins back to October 1
Microsoft says to review activity from October 15, 2026, at minimum, and to take service-principal sign-ins back to October 1 where logs allow. The earlier window catches failed attempts and unusual volume that came before the public reports. Microsoft also recommends least privilege for multi-tenant app permissions and consent grants, so a single compromised vendor app can reach less of the tenant.
"Review activity starting from at least October 15, 2026.／Where records are available, extend service-principal sign-in review to October 1／Apply least privilege to multi-tenant application permissions and consent grants." — Microsoft Security Blog, “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise”View official source →
A sign-in doesn't prove data was stolen
Finding an affected app, or even a successful sign-in by the group, doesn't on its own mean customer data was accessed or taken. Microsoft saw sign-ins and follow-on activity in several customer environments but keeps that separate from data theft.
Where suspicious activity is confirmed, Microsoft says to revoke unnecessary permissions and rotate credentials. Removing unauthorized credentials, grants, owners and role assignments should happen after the evidence is saved, by someone with the authority to do it.
"The presence of an affected application, or even successful authentication, does not necessarily indicate unauthorized data access or data exfiltration.／On confirmed suspicious activity, revoke unnecessary permissions and rotate credentials." — Microsoft Security Blog, “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise”View official source →
Other Microsoft 365 tenants have the same entry points
Two entry points, two owners
| Entry point in this case | Who closes it | What to do |
|---|---|---|
| Third-party apps with consent to Microsoft 365 | Admins | List every consented app and cut permissions to what it needs |
| Common passwords tried across many accounts | Employees | Use a strong, unique password and turn on MFA |
The two ways in here were a vendor app the organization had already trusted and passwords common enough to guess. Neither depends on ConnectWise. Any tenant that has granted a third-party app access to its mail or files has the same kind of door.
The specific ConnectWise fix doesn't cover apps from other vendors. The checks below apply whether or not you've ever used ConnectWise.
For admins: review the third-party apps you've consented to
Start by listing every third-party app that has consent in your Microsoft 365 tenant, and what each one is allowed to reach. Microsoft's own advice for this incident is to apply least privilege to multi-tenant app permissions and consent grants.
The same audit-log checks Microsoft lists for ConnectWise customers work for any vendor app. Look for credentials added to apps, new owners, consent grants and privileged role assignments that nobody on your team made.
"Apply least privilege to multi-tenant application permissions and consent grants.／Review Microsoft Entra audit records for application or service-principal credential additions" — Microsoft Security Blog, “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise”View official source →
For employees: use strong passwords and MFA
On the employee side, the job is a strong, unique password on work accounts and multifactor authentication switched on. The password spray in this case worked by trying passwords that many people use.
CISA, the US Cybersecurity and Infrastructure Security Agency, makes the same point on its "More than a Password" page, which is now archived. It says a password alone, even a complex one, can still be bypassed, and that a second way to verify your identity makes accounts much safer. Its advice is to begin with the security settings of the accounts you use most.
"Your password isn’t protecting you the way you think it is.／Multifactor authentication (MFA) can make you much more secure.／Start by looking at the security settings on your most-used accounts." — CISA, “More than a Password”View official source →
FAQ
- Who is Storm-0940?
- Storm-0940 is a hacking group that has been stealing data from organizations in many industries since 2021. Microsoft assesses it as China-aligned and says the group has no known aliases elsewhere in the security industry.
- Is ARTEX a vulnerability I need to patch?
- No. ARTEX is an open-source penetration testing framework, not a flaw in Microsoft 365. Microsoft says the activity didn't come from a compromise of or vulnerability in its own products. What helps is reviewing app consent, permissions and sign-in logs.
- If the group signed in to our tenant, was our data stolen?
- Not necessarily. Microsoft says an affected app or even a successful sign-in doesn't on its own show that data was accessed or taken. Preserve the logs, then check mail and file access, downloads and forwarding rules to see what actually happened.
Related articles
North Korean hackers embed AI in their operationsMicrosoft rated eight North Korean hacking groups on AI use on October 29, 2026. Three run AI across entire operations, from fake recruiters to malware.
Unreleased Claude made 5 exploit chains, all fixedOn October 27, Anthropic said an unreleased Claude model chained bugs in Chrome, Safari, Android, Windows and Linux into five exploits. All are fixed.
LiteLLM 1.107.0 shipped with a credential stealerLiteLLM 1.107.0 on PyPI and Docker carried malware that steals credentials when Python starts. LiteLLM says hosts that installed it Oct 21 are compromised.
AGENTS.md in Downloads hijacks AI coding agentsAn AGENTS.md in a Downloads folder told Codex to install malware. In Forever Security's tests, Codex obeyed over 90% of the time and Claude Code about half.