Summary
- Microsoft links Storm-0940 to malicious use of ConnectWise application identities in customer tenants.
- ARTEX-assisted activity included attempted access to more than 2,250 Microsoft 365 tenants.
- Most attempts failed, but Microsoft reports privileged persistence in some environments; the number of stolen records is not established.
Microsoft has attributed activity involving compromised ConnectWise cloud application identities to Storm-0940, a China-aligned threat actor, and says agentic AI tooling accelerated attempts against thousands of customer Microsoft 365 environments. Its 21 October research adds a named attribution and technical account to the ConnectWise incident already disclosed by the service provider.
The group used ARTEX, an open-source framework that applies AI models to penetration testing tasks, to automate reconnaissance and authentication activity. Microsoft says the actor attempted to reach more than 2,250 tenants through compromised application permissions, in periods reaching 2,900 sign-in attempts a minute. These figures describe targeting and attempted authentication; they are not a count of organisations confirmed to have suffered data theft.
Between 10 and 14 October, Microsoft separately observed more than 151,000 failed sign-in attempts directed at 327 accounts across eight organisations. The activity involved password spraying, which tests credentials across multiple accounts, as well as later attempts to abuse application identities. Microsoft says some sequences progressed from selection of a target to privileged access in fewer than three hours.
ConnectWise had already disabled affected Cloud Backup identities and restricted services while investigating unauthorised access. In an earlier Cyber Insider report, the immediate issue was containment of seven application identities and disruption to cloud backup services. The subsequent Microsoft research instead traces the actor’s operating method, scale and attempts to establish persistence.
Permissions granted to applications extend the intrusion
Cloud backup and administration tools commonly receive application permissions so they can access customer services without repeatedly asking an individual user to sign in. If credentials belonging to an application identity are stolen, an attacker can try to act through rights the customer previously granted to that application. The initial compromise may therefore occur at a technology supplier while the resulting unauthorised activity appears in a customer’s cloud tenant.
Microsoft observed abuse of Microsoft Graph interfaces and attempts to change application credentials and privileges. Modifying an existing application identity or attaching another secret can provide a route to persistence even after the original connection is disabled. The exact result depends on permissions already granted and any successful modifications in individual tenants; an authentication event alone does not prove files or messages were accessed.
The researchers describe ARTEX as an acceleration tool rather than a vulnerability in Microsoft 365. The actions reported — password spraying, misuse of credentials, reconnaissance and privilege changes — predate the present wave of agentic AI systems. Automation changes their speed and concurrency, potentially shortening the time available for operators to detect activity before an attacker has taken further steps.
Microsoft says most of the targeting attempts did not succeed, while some operations nevertheless resulted in persistent privileged cloud access. It has not disclosed a single verified total of compromised customers. Its attribution remains a Microsoft intelligence assessment, not a judicial finding concerning the operators or their sponsors.
ConnectWise has been restoring affected services in phases, with partners and customers responsible for determining whether the original application permissions or downstream tenant settings were abused. The new research identifies how an attacker could cross a managed service boundary into multiple independent customer environments without compromising each one through a separate software flaw.
The targeting figures describe separate phases that should not be added together to estimate a single victim total. The 151,000 failed password attempts belong to a specified campaign window and small set of organisations, while the larger tenant figure refers to subsequent application-based activity. A tenant can be contacted by the attacker’s infrastructure without its owner suffering a successful compromise. Equally, a tenant that shows an apparently valid third-party service sign-in may warrant investigation even without a failed-password spike, because application identities use different authentication paths.
The compromised supplier connection and any cloud identities modified through it require separate review to determine whether persistence survived the initial containment. Microsoft’s account reports both the scale of attempted access and evidence of follow-on persistence, while leaving the confirmed total of compromised organisations and the scope of any data loss unresolved.
