Storm-0940 Weaponizes ARTEX AI Framework in ConnectWise Cloud Backup Supply Chain Attack

Managed service providers and cloud backup applications remain prime targets for state-sponsored threat actors because a single trust relationship can provide access to thousands of downstream enterprise networks. In a recent disclosure, Microsoft revealed that China state-aligned threat group Storm-0940 orchestrated a major supply chain compromise of the ConnectWise Cloud Backup application. To carry out the campaign at scale, Storm-0940 integrated ARTEX—a Go-based agentic AI penetration testing tool—to automate reconnaissance, cross-tenant password spraying, and cloud identity takeovers at machine speed. By hijacking legitimate service application identities, the attackers bypassed interactive user sign-in and multi-factor authentication (MFA) protections across hundreds of downstream victims.

Supply Chain Compromise at Machine Speed

Storm-0940, an adversary active since at least 2021 and previously associated with the Quad7 (CovertNetwork-1658) botnet, initiated high-volume automated attacks in mid-October 2026. Between October 10 and October 14, infrastructure tied to the threat actor at IP address 144.172.64[.]99 launched an automated cross-tenant password spray campaign targeting Exchange Online and Microsoft 365 accounts. This phase involved over 151,000 failed authentication events targeting 327 accounts across eight organizations, peaking on October 11 at a rate of 2,900 failed logon attempts per minute—yielding more than 111,000 failures in a single day.

The attack escalated on October 15, 2026, when Storm-0940 successfully compromised the core identities of multiple ConnectWise cloud applications. Armed with these stolen application credentials, the threat actor deployed ARTEX AI agents to authenticate directly to downstream customer environments. Because cloud backup solutions require high-privilege application permissions (such as Microsoft Graph API directory read/write access), the AI agents were able to abuse already established cross-tenant trust relationships. In multiple cases, the window from initial targeting to full privileged access across a victim’s cloud infrastructure was less than three hours.

Inside the ARTEX Agentic AI Framework

ARTEX was originally designed as an offensive Go-based penetration testing tool before being taken closed-source following its misuse in cyberattacks against South Korean financial institutions (tracked by Recorded Future Insikt Group under the moniker TAG-217). Recent research from Zscaler ThreatLabz reveals that the framework relies on Large Language Model (LLM) backends routed through OpenAI-compatible gateways. While configurations varied, the agents actively leveraged DeepSeek, GLM, and Grok models to execute complex multi-stage attack workflows.

The technical mechanics of the framework allow autonomous sub-agents to divide tasks and peer-review each other’s outputs—for example, directing a GLM instance to review and refine scanning results generated by a DeepSeek agent. During the ConnectWise campaign, prompt histories showed agents requesting bulk personal and transaction data, inquiring about monetizing stolen data, attempting to extract payment gateway API keys, and exploiting administrative workflows. By operating autonomously 24/7 without human latency, ARTEX allowed Storm-0940 to maintain continuous, parallel attack vectors across thousands of targets simultaneously.

Impact, Blast Radius, and Lateral Persistence

The geographic and vertical reach of this campaign is extensive. Confirmed target sectors span aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and non-profit think tanks globally.

The blast radius for organizations utilizing ConnectWise Cloud Backup extends well beyond simple credential theft. Once inside a victim’s Microsoft Entra ID (formerly Azure AD) tenant, ARTEX agents executed Microsoft Graph calls to perform directory reconnaissance and alter application credentials. The threat actor specifically modified permissions and added new secrets to existing OAuth applications within victim environments. This tactic creates secondary backdoors: even if an administrator revokes the compromised ConnectWise application registration or resets primary user accounts, the rogue credentials assigned to secondary enterprise apps allow Storm-0940 to retain persistent, unauthenticated access to Microsoft 365 resources indefinitely.

In response to the incident, ConnectWise temporarily shut down affected cloud services to contain the exposure and has begun restoring services in phases over a multi-day recovery window.

Defensive Recommendations and Incident Response

Organizations operating ConnectWise Cloud Backup or managing multi-tenant Microsoft 365 environments should immediately execute the following technical containment steps:

• Audit and Revoke Service Principal Credentials: Inspect all registered Enterprise Applications and App Registrations in Entra ID for new client secrets, certificates, or modified API permissions added since October 2026. Immediately remove unrecognized credentials from any app connected to ConnectWise.
• Review Microsoft Entra Audit Logs: Search audit logs for sign-in events or Graph operations associated with IP address 144.172.64[.]99 or associated subnets. Look specifically for operations matching Update application or Add service principal credentials.
• Re-Authenticate Application Trust: Terminate existing OAuth refresh tokens and re-consent to ConnectWise application permissions only after confirming that ConnectWise services have been safely restored and verified clean in your tenant.
• Restrict Service Principal Privileges: Enforce strict Conditional Access policies for workload identities where possible, restricting service principal activity to approved IP ranges and location boundaries.