Storm-0940 weaponizes ARTEX agent to breach 2,250 M365 tenants via ConnectWise

Storm-0940 weaponizes ARTEX agent to sweep 2,250 M365 tenants via ConnectWise trust

A severe multi-tenant cloud supply chain compromise has exposed 2,250 Microsoft 365 enterprise tenants to unauthorized administrative intrusion and targeted data exfiltration. Disclosed by Microsoft Threat Intelligence (MSTI) on 22 October 2026, the incident targeted the backend infrastructure of ConnectWise Cloud Backup (formerly SkyKick, acquired by ConnectWise in 2024). The China-nexus threat actor tracked as Storm-0940 exfiltrated production X.509 private signing certificates associated with the vendor's multi-tenant Microsoft Entra ID enterprise application registration.

Armed with the stolen private key, the threat actor did not rely on manual human operators to traverse the compromised customer base. Instead, Storm-0940 integrated the credentials into an automated weaponized deployment of the open-source ARTEX agentic offensive framework. The autonomous agent executed OAuth 2.0 token requests against Microsoft Entra authentication endpoints at a peak velocity of 2,900 sign-in requests per minute (48.33 requests per second, derived). In under three hours, the autonomous agent swept across all 2,250 customer tenants, catalogued user directories, and initiated targeted Microsoft Graph API queries against executive mailboxes and sensitive SharePoint repositories.

What this establishes from the official record. ConnectWise confirmed that on 15 October 2026, its security teams observed anomalous administrative interactions and temporarily suspended the Cloud Backup service to isolate the compromised service principal. Microsoft revoked the rogue application certificates on 16 October 2026, terminated all active application tokens, and sent direct notifications to administrators across all 2,250 impacted tenants. What this does not establish. The primary disclosures do not establish whether Storm-0940 succeeded in exfiltrating full mailbox archives across all 2,250 organizations, nor whether the initial foothold within ConnectWise stemmed from an unpatched edge appliance, stolen administrative developer credentials, or a third-party vendor dependency.

Non-Human Identity failure: how multi-tenant OAuth pre-consent collapsed

The architectural root of this breach lies in the structural mechanics of Microsoft Entra ID multi-tenant SaaS application registrations and Non-Human Identities (NHIs). When an enterprise customer deploys a cloud backup solution like ConnectWise Cloud Backup, a tenant administrator performs a one-time administrative consent ceremony. This operation instantiates a local Service Principal inside the customer's Entra tenant that references the vendor's central multi-tenant Application (client) ID.

In Microsoft Entra ID, application authentication can be conducted via two credential types: shared client secrets (passwords) or asymmetric X.509 public-key certificates. Enterprise software vendors utilize certificates for stronger cryptographic binding. To request an access token for an individual customer tenant, the caller constructs a signed JSON Web Token (JWT) client assertion using its private key and submits an HTTP POST request to the target tenant's OAuth 2.0 token endpoint:

POST /a1b2c3d4-victim-tenant-id/oauth2/v2.0/token HTTP/1.1
Host: login.microsoftonline.com
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&client_id=00000000-connectwise-app-id
&client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer
&client_assertion=eyJhbGciOiJSUzI1NiIsIng1dCI6Ik1...[Stolen Key Signature]...Sg
&scope=https%3A%2F%2Fgraph.microsoft.com%2F.default

When Microsoft's token issuance authority processes this request, it verifies that the client_assertion JWT is validly signed by the public key registered on the ConnectWise multi-tenant application. Upon verification, Entra issues a scoped access token possessing every application permission previously consented by the customer. Because the grant is client_credentials, the token represents the workload itself rather than an interactive user session. Standard identity protections, such as FIDO2 security keys, user MFA challenges, and risk-based user sign-in policies, never execute because no human user is participating in the exchange.

Agentic AI weaponization: the ARTEX autonomous exploitation engine

The operational breakthrough distinguishing this campaign from historical cloud intrusions is Storm-0940's operationalization of agentic artificial intelligence. Rather than scripting linear API queries or manually inspecting individual tenants through administrative consoles, the threat actor coupled the stolen signing certificate to a customized deployment of ARTEX, an open-source autonomous agentic penetration testing framework.

According to telemetry documented in Microsoft's threat intelligence report, the threat actor generated peak traffic of 2,900 sign-in attempts per minute across the victim cohort. At 48.33 requests per second (derived), the agent executed an initial validation and directory sweep across all 2,250 tenants in exactly 46.55 seconds (derived). Across the entire campaign lifecycle, the total time from initial credential loading to elevated control across 2,250 tenants was under 3.0 hours (180 minutes). This yields an average dwell time of just 4.80 seconds per tenant (derived).

Comparative operational metrics: ARTEX agentic automation vs human operational baselines

Operational Metric	ARTEX Autonomous AI Agent	Human Red-Team (15 min/tenant)	Human Red-Team (30 min/tenant)
Tenant Cohort Size	2,250 Tenants	2,250 Tenants	2,250 Tenants
Total Execution Time	< 3.0 Hours (180 min)	562.5 Hours (14.1 work weeks)	1,125.0 Hours (28.1 work weeks)
Average Dwell per Tenant	4.80 Seconds (derived)	15.0 Minutes	30.0 Minutes
Initial Sweep Velocity	46.55 Seconds (derived)	37.5 Hours (derived)	75.0 Hours (derived)
Acceleration Factor	Baseline (1x)	187.5x Slower than ARTEX	375.0x Slower than ARTEX
Detection Window Opportunity	Sub-minute burst	Weeks to months	Multi-quarter campaign

The ARTEX agentic architecture operated via a closed-loop observation-action-evaluation cycle. The framework ingested the list of target tenant IDs and the stolen certificate, continuously requested scoped OAuth tokens, evaluated the directory schema of each victim organization, prioritized C-suite executive accounts based on job titles and organizational hierarchy attributes, and issued batch Graph API calls to retrieve high-value inbox items (/v1.0/users/[id]/messages?$filter=...) and sensitive SharePoint sites. By managing its own concurrency, handling Microsoft Entra rate-limiting backoffs (HTTP 429 Retry-After headers) dynamically, and shifting source egress IP ranges, the agent compressed campaigns that traditionally required months of human reconnaissance into an afternoon.

Remediation and defense: hardening Non-Human Identities against agentic sweeps

The ConnectWise compromise demonstrates that modern cloud security perimeters are vulnerable to vendor non-human identity theft. Because SaaS vendors routinely require broad application scopes to fulfill automated backup and archival functions, an adversary who compromises the vendor acquires instantaneous, unattended reach into every customer environment. Defending against autonomous agentic attacks requires transitioning from static credential consent to continuous workload identity governance.

Defensive controls and mitigation strategies for multi-tenant SaaS application risks

Control Domain	Vulnerability Vector	Recommended Defensive Engineering Control
Workload Identity Policy	Static X.509 private keys stored on vendor servers	Enforce Microsoft Entra Workload ID Conditional Access restricting token minting by IP and location.
Application Permissions	Tenant-wide broad scopes (e.g. Mail.ReadWrite)	Enforce Application Access Policies in Exchange Online to restrict service principals to designated mailboxes.
Velocity & Anomaly Detection	2,900 sign-in attempts per minute across tenants	Deploy Microsoft Defender for Cloud Apps with autonomous rate-anomaly detection for Service Principals.
Federated Authentication	Long-lived signing certificates (1-2 years)	Mandate Workload Identity Federation (OIDC) eliminating static shared secrets and persistent private keys.
Audit & Inventory	Dormant and legacy multi-tenant app consent	Implement automated quarterly app consent reviews and revoke permissions for inactive SaaS integrations.

For security teams responding to the ConnectWise advisory, Microsoft recommends reviewing Entra sign-in logs specifically filtered by Service Principal sign-ins for Application ID 00000000-connectwise-app-id (and historical SkyKick app IDs) between 12 October and 16 October 2026. Security operations centers must evaluate whether any mail items or files were accessed via the Graph API during the observed anomaly windows, rotate all related secrets, and verify that the revoked certificates are no longer active in local tenant service principal registrations.