Microsoft disclosed on October 21 that a China state-aligned actor it tracks as Storm-0940 was behind the recent compromise of the ConnectWise Cloud Backup application, which we covered on October 17 after Huntress found its credential being used in 173 Microsoft 365 tenants. Microsoft says the actor used ARTEX, a multi-agent AI penetration-testing framework written in Go that can drive any AI model, to automate scanning, password spraying and abuse of OAuth applications “at machine speed”. Microsoft says the activity began as early as September 2026, reached hundreds of organizations across many sectors, and in several cases went from first targeting to privileged cloud access in under three hours. ARTEX was also named in the South Korean bank breaches earlier this month, and Microsoft says it has seen actors in several regions using it.
The timeline in Microsoft’s write-up: from October 10 to 14, infrastructure at 144.172.64[.]99 ran a cross-tenant password-spray against 327 accounts at eight organizations, producing more than 151,000 failed sign-ins (peaking at 2,900 per minute on October 11), with no successful authentication seen. On October 15, after the actor gained control of several ConnectWise cloud application identities, the same IP range signed in to customer tenants through those apps, which already had the tenants’ trust. Microsoft says ARTEX tried to sign in to more than 2,250 tenants at about 2,900 attempts per minute. In some tenants the agents went on to Microsoft Graph and directory operations: reconnaissance, application-credential changes, and changes to identities, groups and privileged roles. Microsoft warns that such credential changes can stay in place as a backdoor even after the original compromised application is dealt with. It also says the activity did not come from a flaw in Microsoft’s own products, and that an affected application or even a successful sign-in does not by itself mean data was accessed or taken. ConnectWise said it is restoring services in phases over several days.
How to check if you’re affected
Affected products are Microsoft 365 tenants where a ConnectWise cloud application, including Cloud Backup (formerly SkyKick), is or was installed or authorized, even if the integration is no longer in use. Microsoft’s guidance, in its own order:
- Keep the affected ConnectWise application connections disabled until ConnectWise gives formal restoration instructions. Do not delete the enterprise applications as a first step; preserve their configuration and evidence before making irreversible changes.
- Look up the application IDs listed in Microsoft’s post (search by application ID, not display name) and record the service-principal Object ID in each tenant.
- Preserve Entra sign-in and audit logs, Purview audit records and any SIEM data, and review activity from at least October 15, 2026. If records allow, extend the service-principal sign-in review back to October 1. Review successful and failed service-principal sign-ins separately, and do not limit the review to the published IP addresses.
- In Entra audit records, look for application or service-principal credential additions, new applications, service principals or owners, app-role assignments and consent grants, privileged role assignments, and changes to users, groups, authentication methods or Conditional Access.
- In Microsoft 365 audit records, look for unusual mail or file access, downloads, forwarding, inbox or transport rules, and delegated mailbox permissions.
- On confirmed suspicious activity, revoke unnecessary permissions and rotate credentials; Microsoft says an authorized responder should remove confirmed unauthorized credentials, grants, owners, assignments and identities after evidence is preserved.