Threat reportSupply ChainTL-2026-4060

Storm-0940 Uses ARTEX Agentic AI Framework in ConnectWise/SkyKick OAuth Supply-Chain Compromise of Microsoft 365 Tenants

criticalACTIVE

Storm-0940 Uses ARTEX Agentic AI Framework in (TL-2026-4060), also tracked as ConnectWise Cloud Backup supply-chain compromise, is a critical-severity supply-chain compromise, first published 2026-10-21 and last reviewed 2026-10-23. It is attributed to Storm-0940 (China) with medium confidence, affects ConnectWise ConnectWise Cloud Backup for Microsoft 365 (formerly, maps to 21 MITRE ATT&CK techniques (T1069.003, T1078.004, T1087.004), and is covered by 9 detection rules and 31 indicators of compromise.

Severity
CRITICALAssessed severity
CVEs
0None referenced
Techniques
21MITRE ATT&CK
Actors
1Storm-0940
Detection rules
9SPL · KQL · Sigma
IOCs
31Indicators of compromise

Key facts for TL-2026-4060

Threat ID
TL-2026-4060
Also known as
ConnectWise Cloud Backup supply-chain compromise, SkyKick vendor credential abuse
Severity
CRITICAL
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
Last reviewed
Attribution
Storm-0940
Attribution confidence
MEDIUM
Nation-state nexus
China
Motivation
ESPIONAGE
Target sectors
aerospace, defense, automotive, chemicals, energy, finance, government administration, legal, manufacturing, news - media, military, semi-conductors
Target regions
Global
Detection rules
9
Indicators of compromise
31
Updates
2026-10-23 · 3 updates · revalidated 3× · latest source

Malware and tooling in Storm-0940 Uses ARTEX Agentic AI Framework in

Malware and tooling: Storm, ARTEX, ConnectWise - S0591

How Storm-0940 Uses ARTEX Agentic AI Framework in works

Microsoft Threat Intelligence attributes the October 2026 abuse of ConnectWise Cloud Backup (formerly SkyKick) and ConnectWise Cloud Management multi-tenant OAuth application credentials to Storm-0940, a China-state aligned actor active since 2021. The actor used ARTEX, an open-source multi-agent LLM penetration testing framework, to automate password spraying, app-only sign-ins to more than 2,250 tenants, Microsoft Graph reconnaissance, service-principal role self-assignment (including Global Administrator) and credential planting. In multiple instances privileged cloud access was reached less than 3 hours after targeting.

On 2026-10-21 Microsoft Threat Intelligence published its analysis of a large, AI-driven campaign by Storm-0940, a China-state aligned threat actor active since 2021 that steals data from organizations in many industries. Storm-0940 has historically gained initial access through password spraying and exploitation of internet-facing applications, persisted in the cloud by adding credentials to existing OAuth applications, and used Microsoft Graph to access email and organizational data. Its historical targets include aerospace/defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, think tanks and nonprofits. Microsoft says that starting in September 2026 the actor used ARTEX to run automated operations against hundreds of organizations worldwide. ARTEX is an open-source penetration testing framework that can use any AI model to automate offensive security workflows. It is a multi-agent LLM system written in Go with a Next.js frontend. It stores discovered assets and vulnerabilities in a graph and runs from reconnaissance through exfiltration with very little human input. Its UI and output default to English but can be switched to Korean, Mandarin, Spanish or Japanese.

ARTEX was released on GitHub on 2026-07-26 by the developer 'Autumn-27' under AGPL-3.0. It uses a harness/orchestrator, a planner that breaks an engagement into tasks, worker agents that run tools and record findings, and a reporting component. On 2026-10-07 CrowdStrike reported that an unattributed, Chinese-speaking and probably financially motivated operator had used ARTEX with DeepSeek, Zhipu GLM, xAI Grok and Claude Code against South Korean financial institutions, exposing PII for about 67,000-68,000 people. On 2026-10-08 the developer pulled the project from GitHub and said it would become closed-source, but forks and mirrors remain available. That Korean campaign is a separate operator. It shows that ARTEX was already being used offensively before Storm-0940's use of it.

Supply-chain abuse chain: (1) Password spray. From 2026-10-10 to 2026-10-14, Storm-0940 infrastructure at 144.172.64.99 (AS14956, RouterHosting) ran an automated cross-tenant password spray against 327 accounts in eight organizations, targeting Microsoft 365 and Exchange Online. The attack mixed broad low-rate spraying with sustained high-volume attempts. Microsoft recorded 151,000+ failed logons, with a peak of 2,900 failures per minute on 2026-10-11 and more than 111,000 failures in one day. 48 accounts each received more than 1,000 failures. Responses were overwhelmingly lockouts and the spray produced no successful compromise. Huntress separately saw spraying against law-firm tenants on 2026-10-13/14, curl/7.88.1 user agents during spraying, and broad failed logins from 144.172.94.243 in the same ASN. (2) Vendor credential compromise. Storm-0940 obtained the vendor-side client credential (client assertion / API secret) of the ConnectWise Cloud Backup multi-tenant Entra application (app ID 506e08f9-6e9a-4da4-942b-a099a03644ae, owner tenant 3f9cd7a0-127a-4ed4-bf06-2f830d5616b7) and of related ConnectWise Cloud Management applications for MS Teams, MS Graph, Exchange Online, SharePoint Online and Partner Center, plus the SkyKick Partner Portal app. Each customer tenant had already consented to these apps, in some cases with privileged permissions such as Directory.ReadWrite.All. Authenticating as the app therefore needed no user sign-in and no new consent, and user-centric controls such as MFA and risky sign-in policies did not apply. (3) Machine-speed app-only sign-ins. On 2026-10-15 public reports of the ConnectWise compromise cited indicators in the same 144.172.64.x range. Microsoft reports that ARTEX then reached more than 2,250 tenants at 2,900 sign-in attempts per minute, including more than 200 sign-ins in under four minutes with four application credentials. Huntress saw the stolen Cloud Backup credential used from 144.172.64.128 between 06:13 and 08:34 UTC on 2026-10-15. It found about 1,000 Entra tenants with sign-in activity from the attacker IP, of which more than 300 succeeded, and had confirmed 162 compromised tenants by 2026-10-16. (4) Post-authentication operations. In some environments the agents went on to Microsoft Graph and directory operations. These included reconnaissance (listing directory objects, permissions and approvals), adding credentials to applications for persistence, and changing identities, groups and privileged roles. In about 50 tenants monitored by Huntress, service principals of the ConnectWise Cloud Management apps assigned themselves directory roles, mostly Exchange Administrator. In one tenant, Cloud Management - MS Teams assigned itself Global Administrator at 03:44 and 03:48 UTC on 2026-10-15. Client secrets valid until 2028 were then added to other enterprise applications, including MSP management tooling and the Huntress application (6 successful and 3 failed attempts). A certificate addition was rejected. These credential additions used the Python-urllib/3.12 user agent. Huntress described the activity as 'fast, scripted, and notably indiscriminate': two compromised tenants showed identical procedures two minutes apart, and escalation plus credential planting took about five minutes. Microsoft also observed Graph access through the compromised apps from transient VPN IPs (187.15.88.186, 187.15.90.217, 187.15.89.186). Defender for Cloud Apps detections covered high-volume mailbox access, Teams message access and SharePoint enumeration by the OAuth apps. Microsoft cautions that an affected app being present, or a successful authentication, does not by itself mean data was accessed or exfiltrated. Huntress cautions that Graph directory reads leave no audit trail.

Vendor response: ConnectWise published an advisory on 2026-10-16 (17:47 UTC) about unauthorized access to application identities in the Cloud Backup environment. It suspended Cloud Backup, SaaS Security and Cloud Management on 2026-10-17 (05:01 UTC) and disabled seven application identities at 07:00 UTC that day, which invalidated the shared Cloud Backup credentials. ConnectWise reports no indication that partner backup archives were compromised and began a phased restoration on 2026-10-21 (19:00 UTC). Access tokens issued before the identities were disabled may stay valid until they expire. Any credentials, role assignments or grants the actor planted on other identities also survive vendor-side rotation, so each tenant must hunt and remediate them. No CVE or CVSS score has been assigned.

MITRE ATT&CK techniques used in TL-2026-4060

Discovery

T1069.003 Cloud Groups; T1087.004 Cloud Account; T1580 Cloud Infrastructure Discovery

Initial Access

T1078.004 Cloud Accounts; T1195 Supply Chain Compromise; T1199 Trusted Relationship

Command and Control

T1090 Proxy

Persistence

T1098.001 Additional Cloud Credentials; T1136.003 Create Account: Cloud Account

Privilege Escalation

T1098.003 Additional Cloud Roles

Credential Access

T1110.003 Password Spraying; T1528 Steal Application Access Token; T1555.006 Credentials from Password Stores: Cloud Secrets Management Stores; T1606 Forge Web Credentials

Collection

T1114.002 Remote Email Collection

lateral-movement

T1550.001 Application Access Token

Resource Development

T1588.002 Tool; T1588.007 Obtain Capabilities: Artificial Intelligence

Reconnaissance

T1594 Search Victim-Owned Websites; T1595 Active Scanning; T1595.002 Active Scanning: Vulnerability Scanning

Affected products and versions in Storm-0940 Uses ARTEX Agentic AI Framework in

  • ConnectWise — ConnectWise Cloud Backup for Microsoft 365 (formerly SkyKick Cloud Backup)
    Vulnerable versions: Multi-tenant Entra app 506e08f9-6e9a-4da4-942b-a099a03644ae consented in customer tenants before 2026-10-17
    Fixed in: Application identity disabled and credentials invalidated 2026-10-17; phased restoration from 2026-10-21
  • ConnectWise — ConnectWise Cloud Management (MS Teams, MS Graph, Exchange Online, SharePoint Online, Partner Center apps)
    Vulnerable versions: App IDs 2399d300-6fca-4e6a-a686-399fefe75b83, 24205314-2b89-4e07-a2a4-579e898a5640, b78f6a77-d4e5-46fb-87e5-d1648bd02519, 0de14c77-b9b0-4137-9360-34878a929827, 412dcf96-176d-4b3a-a1b0-4981ad66971e, b2b55f5b-7758-4719-8d8f-88ae172e6bdb
    Fixed in: Application identities disabled 2026-10-17
  • ConnectWise — SkyKick Partner Portal / ConnectWise SaaS Security
    Vulnerable versions: SkyKick Partner Portal app c921256f-04a7-44e8-9b2a-69c33929ba19; SaaS Security suspended due to integration dependencies
    Fixed in: Service suspension 2026-10-17; phased restoration from 2026-10-21
  • Microsoft — Microsoft 365 / Microsoft Entra ID / Exchange Online / Microsoft Graph tenants consenting to the affected apps
    Vulnerable versions: Any tenant with the affected service principals enabled
    Fixed in: Tenant-side: disable affected apps and remove attacker-added credentials/roles

Remediation for Storm-0940 Uses ARTEX Agentic AI Framework in

Patches

  • No CVE/patch: ConnectWise disabled seven application identities on 2026-10-17 (invalidating shared Cloud Backup credentials) and began phased service restoration on 2026-10-21 per its Technical Investigation and Remediation Guide

Immediate actions

  • Disable (do not delete) the ConnectWise/SkyKick enterprise applications in Microsoft Entra ID until ConnectWise confirms credential reset and restoration: 506e08f9-6e9a-4da4-942b-a099a03644ae, 24205314-2b89-4e07-a2a4-579e898a5640, 0de14c77-b9b0-4137-9360-34878a929827, c921256f-04a7-44e8-9b2a-69c33929ba19, 2399d300-6fca-4e6a-a686-399fefe75b83, b78f6a77-d4e5-46fb-87e5-d1648bd02519, 412dcf96-176d-4b3a-a1b0-4981ad66971e, b2b55f5b-7758-4719-8d8f-88ae172e6bdb
  • Preserve evidence before removing anything: export Entra sign-in (including service principal sign-ins) and audit logs, Microsoft Purview Audit, MicrosoftGraphActivityLogs and SIEM data
  • Inventory every tenant (current and historical) where the affected apps were consented and record the service principal object IDs per tenant
  • Review service principal sign-ins for the affected app IDs from 2026-10-15 onward (extend back to 2026-10-01 where logs allow), separating successful and failed sign-ins and flagging any source outside expected vendor/Azure egress, especially 144.172.64.128, 144.172.64.99, 144.172.64.60, 144.172.94.243, 187.15.88.186, 187.15.90.217 and 187.15.89.186
  • Hunt Entra audit logs for 'Add member to role', 'Add service principal credentials', 'Update application' and new app/service principal creation initiated by ConnectWise/SkyKick service principals since 2026-10-13; remove unauthorized client secrets/certificates (look for secrets expiring in 2028) on ALL enterprise apps, starting with MSP management and security tooling
  • Remove directory role assignments (Global Administrator, Exchange Administrator) self-assigned by the affected service principals
  • Review Microsoft 365 audit records for Graph reconnaissance, unusual mailbox/Teams/SharePoint access, file downloads, new inbox/forwarding rules and delegated permission grants
  • Block the listed IOC IPs and alert on the user agents Python-urllib/3.12, python-requests/2.31.0, python-requests/2.34.2, curl/7.88.1 and azure-toolkit/1.0 for app-only and user sign-ins

Workarounds

  • Keep the affected ConnectWise applications disabled in each tenant until ConnectWise formally confirms restoration
  • Revoke and reissue credentials on any enterprise application that received unexpected secrets or certificates during the incident window

Longer-term hardening

  • Apply least privilege to multi-tenant application permissions and consent grants; remove Directory.ReadWrite.All and RoleManagement-type permissions from third-party apps where not strictly required
  • Continuously monitor credential additions, privileged role assignments to service principals and anomalous app-only Graph activity (Defender for Cloud Apps app governance, Sentinel analytics on AuditLogs/MicrosoftGraphActivityLogs)
  • Use Conditional Access for workload identities (location/risk policies on service principals) and review Conditional Access exclusions for vendor apps
  • Verify that vendor credential rotation actually removed unauthorized access, and assess how backup/restore workflows are affected before re-enabling
  • Assume adversaries operate agentic AI tooling at machine speed: tune detections for high-velocity cross-tenant sign-ins and short escalation windows (under 5 minutes), and enable Microsoft Security Dashboard for AI and Defender for Cloud AI threat protection

Weaknesses (CWE) in Storm-0940 Uses ARTEX Agentic AI Framework in

CWE-307, CWE-287

Timeline of Storm-0940 Uses ARTEX Agentic AI Framework in

  • Developer 'Autumn-27' releases ARTEX, an open-source (AGPL-3.0) multi-agent LLM penetration testing framework, on GitHub.
  • CrowdStrike reports an unattributed Chinese-speaking operator using ARTEX with multiple LLMs (DeepSeek, Zhipu GLM, xAI Grok, Claude Code) against South Korean financial institutions; around 67,000-68,000 individuals' PII exposed. Microsoft separately says Storm-0940 began ARTEX-driven operations in September 2026.
  • ARTEX developer removes the project from GitHub and says it will go closed-source due to misuse; forks and mirrors persist.
  • Storm-0940 infrastructure at 144.172.64.99 begins an automated cross-tenant password spray (through 2026-10-14) against 327 accounts in eight organizations targeting Microsoft 365 and Exchange Online; 151,000+ failed logons, no successful compromise.
  • Spray peaks at 2,900 failures per minute, with more than 111,000 failures in a single day; 48 accounts receive more than 1,000 failures each.
  • Scripted reconnaissance from attacker infrastructure against ConnectWise-linked application identities begins (BleepingComputer); also the Microsoft hunting baseline date.
  • Huntress observes password spraying against law-firm tenants (2026-10-13/14) from the attacker IP range, with curl/7.88.1 user agents.
  • ConnectWise identifies the unauthorized use of its application identities through monitoring; the attacker begins pulling Graph tokens from customer tenants around this date.
  • Initial activity is manual until about 14:20 UTC, followed by a second targeted wave against 16 tenants in policy, national security, trade and critical-minerals sectors (per ConnectWise); victim counts differ by source (Huntress 162 confirmed, other reporting 173, Todyl recon-only in 9 tenants).
  • Stolen ConnectWise Cloud Backup credential used from 144.172.64.128 (06:13-08:34 UTC per Huntress). Service principals self-assign directory roles in about 50 Huntress-monitored tenants. Cloud Management - MS Teams self-assigns Global Administrator at 03:44 and 03:48 UTC and plants client secrets expiring in 2028. ARTEX reaches more than 2,250 tenants at 2,900 sign-in attempts/min (more than 200 sign-ins in under 4 minutes with 4 app credentials). Public reports of the ConnectWise compromise surface.
  • ConnectWise publishes an advisory (17:47 UTC) on unauthorized access to application identities in the Cloud Backup environment; Huntress publishes its analysis and confirms 162 compromised tenants (around 1,000 tenants with attacker sign-in activity, 300+ successful).
  • ConnectWise suspends Cloud Backup, SaaS Security and Cloud Management (05:01 UTC) and disables seven application identities (07:00 UTC), invalidating the shared Cloud Backup credentials.
  • Huntress records failed user logins from related infrastructure 144.172.64.60 (AS14956).
  • Trade press reports that ConnectWise has suspended Cloud Backup, SaaS Security and Cloud Management after the Microsoft 365 tenant compromise.
  • Microsoft Threat Intelligence publishes its attribution of the campaign to China-state aligned Storm-0940 using ARTEX, with IOCs, Defender XDR/Defender for Cloud Apps detections and hunting queries; ConnectWise begins phased service restoration (19:00 UTC).
  • Wiz Research publishes 'ARTEX in the Wild', documenting the ARTEX playbook against IT/software vendors and identity providers (Okta, Entra ID, AWS Cognito) with additional IP and user-agent indicators.

Update history for TL-2026-4060

Sources cited for Storm-0940 Uses ARTEX Agentic AI Framework in

Detection coverage for TL-2026-4060

As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4060 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
31 indicators of compromise · Red and above. Compare plans

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats