# Storm-0940 Uses ARTEX Agentic AI Framework in ConnectWise/SkyKick OAuth Supply-Chain Compromise of Microsoft 365 Tenants

> Microsoft Threat Intelligence attributes the October 2026 abuse of ConnectWise Cloud Backup (formerly SkyKick) and ConnectWise Cloud Management multi-tenant OAuth application credentials to Storm-0940, a China-state aligned actor active since 2021. The actor used ARTEX, an open-source multi-agent LLM penetration testing framework, to automate password spraying, app-only sign-ins to more than 2,250 tenants, Microsoft Graph reconnaissance, service-principal role self-assignment (including Global Administrator) and credential planting. In multiple instances privileged cloud access was reached less than 3 hours after targeting.

- **Published:** 2026-10-21T20:35:25Z
- **Last reviewed:** 2026-10-23T03:36:36.388Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4060
- **ID:** TL-2026-4060
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** Storm-0940 (China)
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-21 Microsoft Threat Intelligence published its analysis of a large, AI-driven campaign by Storm-0940, a China-state aligned threat actor active since 2021 that steals data from organizations in many industries. Storm-0940 has historically gained initial access through password spraying and exploitation of internet-facing applications, persisted in the cloud by adding credentials to existing OAuth applications, and used Microsoft Graph to access email and organizational data. Its historical targets include aerospace/defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, think tanks and nonprofits. Microsoft says that starting in September 2026 the actor used ARTEX to run automated operations against hundreds of organizations worldwide. ARTEX is an open-source penetration testing framework that can use any AI model to automate offensive security workflows. It is a multi-agent LLM system written in Go with a Next.js frontend. It stores discovered assets and vulnerabilities in a graph and runs from reconnaissance through exfiltration with very little human input. Its UI and output default to English but can be switched to Korean, Mandarin, Spanish or Japanese.

ARTEX was released on GitHub on 2026-07-26 by the developer 'Autumn-27' under AGPL-3.0. It uses a harness/orchestrator, a planner that breaks an engagement into tasks, worker agents that run tools and record findings, and a reporting component. On 2026-10-07 CrowdStrike reported that an unattributed, Chinese-speaking and probably financially motivated operator had used ARTEX with DeepSeek, Zhipu GLM, xAI Grok and Claude Code against South Korean financial institutions, exposing PII for about 67,000-68,000 people. On 2026-10-08 the developer pulled the project from GitHub and said it would become closed-source, but forks and mirrors remain available. That Korean campaign is a separate operator. It shows that ARTEX was already being used offensively before Storm-0940's use of it.

Supply-chain abuse chain: (1) Password spray. From 2026-10-10 to 2026-10-14, Storm-0940 infrastructure at 144.172.64.99 (AS14956, RouterHosting) ran an automated cross-tenant password spray against 327 accounts in eight organizations, targeting Microsoft 365 and Exchange Online. The attack mixed broad low-rate spraying with sustained high-volume attempts. Microsoft recorded 151,000+ failed logons, with a peak of 2,900 failures per minute on 2026-10-11 and more than 111,000 failures in one day. 48 accounts each received more than 1,000 failures. Responses were overwhelmingly lockouts and the spray produced no successful compromise. Huntress separately saw spraying against law-firm tenants on 2026-10-13/14, curl/7.88.1 user agents during spraying, and broad failed logins from 144.172.94.243 in the same ASN. (2) Vendor credential compromise. Storm-0940 obtained the vendor-side client credential (client assertion / API secret) of the ConnectWise Cloud Backup multi-tenant Entra application (app ID 506e08f9-6e9a-4da4-942b-a099a03644ae, owner tenant 3f9cd7a0-127a-4ed4-bf06-2f830d5616b7) and of related ConnectWise Cloud Management applications for MS Teams, MS Graph, Exchange Online, SharePoint Online and Partner Center, plus the SkyKick Partner Portal app. Each customer tenant had already consented to these apps, in some cases with privileged permissions such as Directory.ReadWrite.All. Authenticating as the app therefore needed no user sign-in and no new consent, and user-centric controls such as MFA and risky sign-in policies did not apply. (3) Machine-speed app-only sign-ins. On 2026-10-15 public reports of the ConnectWise compromise cited indicators in the same 144.172.64.x range. Microsoft reports that ARTEX then reached more than 2,250 tenants at 2,900 sign-in attempts per minute, including more than 200 sign-ins in under four minutes with four application credentials. Huntress saw the stolen Cloud Backup credential used from 144.172.64.128 between 06:13 and 08:34 UTC on 2026-10-15. It found about 1,000 Entra tenants with sign-in activity from the attacker IP, of which more than 300 succeeded, and had confirmed 162 compromised tenants by 2026-10-16. (4) Post-authentication operations. In some environments the agents went on to Microsoft Graph and directory operations. These included reconnaissance (listing directory objects, permissions and approvals), adding credentials to applications for persistence, and changing identities, groups and privileged roles. In about 50 tenants monitored by Huntress, service principals of the ConnectWise Cloud Management apps assigned themselves directory roles, mostly Exchange Administrator. In one tenant, Cloud Management - MS Teams assigned itself Global Administrator at 03:44 and 03:48 UTC on 2026-10-15. Client secrets valid until 2028 were then added to other enterprise applications, including MSP management tooling and the Huntress application (6 successful and 3 failed attempts). A certificate addition was rejected. These credential additions used the Python-urllib/3.12 user agent. Huntress described the activity as 'fast, scripted, and notably indiscriminate': two compromised tenants showed identical procedures two minutes apart, and escalation plus credential planting took about five minutes. Microsoft also observed Graph access through the compromised apps from transient VPN IPs (187.15.88.186, 187.15.90.217, 187.15.89.186). Defender for Cloud Apps detections covered high-volume mailbox access, Teams message access and SharePoint enumeration by the OAuth apps. Microsoft cautions that an affected app being present, or a successful authentication, does not by itself mean data was accessed or exfiltrated. Huntress cautions that Graph directory reads leave no audit trail.

Vendor response: ConnectWise published an advisory on 2026-10-16 (17:47 UTC) about unauthorized access to application identities in the Cloud Backup environment. It suspended Cloud Backup, SaaS Security and Cloud Management on 2026-10-17 (05:01 UTC) and disabled seven application identities at 07:00 UTC that day, which invalidated the shared Cloud Backup credentials. ConnectWise reports no indication that partner backup archives were compromised and began a phased restoration on 2026-10-21 (19:00 UTC). Access tokens issued before the identities were disabled may stay valid until they expire. Any credentials, role assignments or grants the actor planted on other identities also survive vendor-side rotation, so each tenant must hunt and remediate them. No CVE or CVSS score has been assigned.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588.002 Tool
- T1110.003 Password Spraying
- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1078.004 Cloud Accounts
- T1550.001 Application Access Token
- T1528 Steal Application Access Token
- T1098.003 Additional Cloud Roles
- T1098.001 Additional Cloud Credentials
- T1087.004 Cloud Account
- T1580 Cloud Infrastructure Discovery
- T1069.003 Cloud Groups
- T1114.002 Remote Email Collection
- T1090 Proxy
- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1595.002 Active Scanning: Vulnerability Scanning
- T1594 Search Victim-Owned Websites
- T1606 Forge Web Credentials
- T1136.003 Create Account: Cloud Account
- T1555.006 Credentials from Password Stores: Cloud Secrets Management Stores

## Sources

- [AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (Microsoft Threat Intelligence)](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/)
- [ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks (Huntress)](https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access)
- [ConnectWise Trust Center Advisories - Cloud Backup unauthorized access](https://www.connectwise.com/company/trust/advisories)
- [ConnectWise Status - Cloud Backup incident](https://status.connectwise.com/pages/incident/619cf82551fec9053d612f09/6ad263692dc48705ab3da2cb)
- [Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack (BleepingComputer)](https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/)
- [Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance (CrowdStrike)](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/)
- [ARTEX: Open-Source Agentic Pentesting Tool Linked to South Korean Bank Intrusions (CSA Research Note)](https://labs.cloudsecurityalliance.org/research/csa-research-note-artex-agentic-pentest-bank-breaches-202610/)
- [Threat actor abuses agentic AI pentesting framework to target South Korean financial institutions (Zscaler ThreatLabz)](https://www.zscaler.com/blogs/security-research/threat-actor-abuses-agentic-ai-pentesting-framework-target-south-korean)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4060