Microsoft: Storm-0940 used ARTEX AI framework in ConnectWise supply chain compromise
For the CISO of a regional US bank
Microsoft said in a Security Blog post on Oct. 21 that Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX as early as September to automate attacks on hundreds of organizations globally.1
Microsoft said agents can work around the clock, on weekends and on holidays, and can try multiple breach paths at once, which cuts the time from selecting a target to reaching objectives.1 Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application; ConnectWise publicly reported unauthorized access to customer tenants through multiple OAuth application identities on Oct. 16.1
Microsoft said the actor used already-authorized applications to authenticate to Microsoft 365 customer environments without an interactive user sign-in, and in multiple environments it observed Microsoft Graph activity including reconnaissance, application credential changes and attempts to modify privileges.1
Microsoft said several ARTEX-driven attacks gave the actor privileged access to an organization's cloud infrastructure, including multiple cases where the time from initial targeting to privileged access was less than 3 hours.1
Microsoft said Storm-0940 used ARTEX to reach more than 2,250 tenants at 2,900 sign-in attempts per minute; between Oct. 10 and 14 a password-spray campaign from 144.172.64[.]99 hit 327 accounts across eight organizations with 151,000+ failed logons, and Microsoft observed no successful authentication, token issuance, Graph call or directory change from that campaign.1
Microsoft said the activity did not result from a compromise of or a vulnerability in its corporate systems, products or services, and that an affected application or successful authentication does not necessarily mean customer data was accessed or exfiltrated.1
Access granted to third-party apps can be abused without any user sign-in, so banks and fintechs that rely on vendor apps in Microsoft 365 may need to review those app permissions and credentials more often than their current cycle. Alerts from automated attacks leave little time to respond, which puts pressure on detection and response speed.
Microsoft advised customers to review service principal sign-ins, investigate unexpected application credential or privilege changes, and follow ConnectWise's published containment guidance while preserving evidence.1
Our take. Your patch windows and app-consent reviews assume an attacker who sleeps. Storm-0940 went from first target to privileged cloud access in under three hours, through an app its victims had already approved.
Action. Identity security: Inventory third-party apps holding Microsoft 365 consent; alert within minutes on Graph-driven app credential or privilege changes.