China-linked actor Storm-0940 weaponises ARTEX multi-agent AI framework against 2,250 M365 tenants via ConnectWise

Storm-0940 weaponises ARTEX autonomous AI framework to compromise 2,250 Microsoft 365 tenants

Microsoft Threat Intelligence has published an extraordinary technical investigation revealing that China-aligned cyber espionage group Storm-0940 has operationalised an agentic artificial intelligence framework to conduct automated, machine-speed intrusions across enterprise cloud environments. The threat group weaponised ARTEX, an open-source, multi-agent AI framework developed in Go, to orchestrate reconnaissance, password spraying, and application credential abuse at unprecedented velocity, compromising downstream Microsoft 365 environments across more than 2,250 enterprise cloud tenants.

Rather than relying on human operators to manually navigate target perimeters, Storm-0940 delegated tactical decision-making to autonomous AI agents capable of coordinating distributed actions in parallel. By compromising credentials associated with ConnectWise Cloud Backup (formerly SkyKick), a multi-tenant cloud backup application with extensive delegated directory permissions, the AI agents bypassed multi-factor authentication (MFA) policies. Telemetry recorded peak spraying rates of approximately 2,900 sign-in attempts per minute (48.33 attempts per second, derived), with the entire intrusion lifecycle (from initial target profiling to full administrative takeover) compressed into less than three hours.

Audit of verified technical disclosures versus operational assumptions

Evaluating the strategic threat posed by AI-orchestrated cloud intrusions requires isolating verified engineering observations published by Microsoft Threat Intelligence from broader industry speculation surrounding artificial intelligence capabilities.

Audit of verified technical disclosures in Microsoft Threat Intelligence Advisory versus operational assumptions

Investigation Dimension	Explicitly Verified in Microsoft MSTIC Report	Unverified or Dependent on Tenant Architecture
Threat Actor Attribution	Storm-0940, a China state-aligned cyber espionage group active since at least 2021 (5 years, derived).	The specific civilian ministry or military intelligence directorate directing Storm-0940 operational requirements.
AI Framework Utilization	Weaponisation of ARTEX, an open-source Go-based multi-agent penetration testing framework.	The underlying large language model foundation weights (such as local open-weights versus commercial API endpoints) driving the ARTEX agents.
Target Scope & Velocity	Over 2,250 Microsoft 365 tenants targeted; peak velocity of 2,900 sign-in attempts per minute (174,000 per hour, derived).	The exact proportion of targeted tenants where full domain administrative takeover was achieved versus unsuccessful spraying.
Intrusion Lifecycle Compression	Timeline from initial reconnaissance to global admin privileged takeover accomplished in under 3 hours (180 minutes).	Whether manual human operators took over keyboard control once high-value tenant access was established by the agents.
Initial Access Vector	Compromise of ConnectWise Cloud Backup (formerly SkyKick) enterprise application OAuth credentials.	The exact initial access vector used to compromise ConnectWise's internal application development or key management infrastructure.
Victim Demographics	Hundreds of organizations across aerospace, defence, energy, government, finance, and technology sectors.	The exact volume and classification level of sensitive intellectual property or government communications exfiltrated.

Autonomous intrusion mechanics: how ARTEX coordinates multi-agent cloud exploitation

The operational architecture of the Storm-0940 campaign is defined by the division of labour across specialised, autonomous software agents. In traditional red teaming or human cyber espionage, an operator sequentially runs reconnaissance tools, digests terminal outputs, crafts credential lists, executes spraying attacks, and manually pivots through identity directories. In the Storm-0940 deployment, ARTEX replaced human command-and-control with an asynchronous multi-agent swarm.

Zoom

The intrusion unfolded through five autonomous operational phases coordinated by the ARTEX framework:

1. Autonomous Target Profiling and Reconnaissance: The ARTEX Recon Agent ingested seed industry targets, querying public DNS records, Certificate Transparency logs, and Microsoft Entra ID tenant authorization endpoints. The agent dynamically mapped tenant IDs, verified federated identity domains, and identified whether high-value third-party backup applications were installed.

2. Distributed High-Velocity Credential Spraying: The Spray Agent initiated distributed authentication probes against 2,250 tenants, routing traffic through residential proxy networks to avoid single-source IP bans. By modulating spray cadences and cycling user targets across different tenants, the agent sustained a combined volume of 2,900 sign-in attempts per minute (174,000 attempts per hour) while evading legacy threshold-based lockout rules.

3. ConnectWise Cloud Backup Application Hijacking: Upon identifying environments utilizing ConnectWise Cloud Backup (formerly SkyKick), the OAuth Agent weaponised previously compromised application secrets. Because ConnectWise Cloud Backup is an enterprise backup utility, it inherently possesses pre-consented, high-privilege application permissions (such as full mailbox access and directory read permissions). Bypassing standard interactive login prompts, the agent authenticated directly to Microsoft Graph API using application tokens, rendering user-level MFA entirely ineffective.

4. Autonomous Privilege Escalation and Persistence Injection: Operating via the hijacked application context, the Escalation Agent evaluated existing Entra ID permissions and executed automated privilege escalation. The agent assigned highly sensitive directory permissions, notably RoleManagement.ReadWrite.Directory and AppRoleAssignment.ReadWrite.All. To ensure redundant persistence that survived application secret revocations, the Persistence Agent added rogue certificates and secondary API client secrets to multiple dormant enterprise service principals.

5. Targeted Data Extraction and Exfiltration: The Exfiltration Agent queried the Microsoft Graph API to harvest sensitive executive communications, SharePoint engineering repositories, and Exchange Online mailboxes, streaming encrypted data to attacker-controlled cloud storage infrastructure.

Comprehensive MITRE ATT&CK mapping of the Storm-0940 campaign

The threat intelligence explainer methodology maps the Storm-0940 ARTEX intrusion lifecycle across the MITRE ATT&CK for Enterprise and Cloud matrices, detailing the exact techniques and automated sub-techniques executed during the campaign.

MITRE ATT&CK Matrix Mapping for Storm-0940 ARTEX AI Agent Campaign

Tactical Phase	MITRE Technique ID	Technique Name	Operational Execution in Storm-0940 Campaign
Initial Access	T1199	Trusted Relationship	Abuse of pre-consented ConnectWise Cloud Backup application integration to gain trusted tenant access.
Credential Access	T1110.003	Password Spraying	High-velocity distributed credential spraying orchestrated by ARTEX at 2,900 attempts per minute.
Defense Evasion	T1078.004	Valid Accounts: Cloud Accounts	Direct authentication via application service principals and OAuth bearer tokens, bypassing user MFA.
Persistence	T1098.001	Account Manipulation: Additional Credentials	Automated injection of rogue certificates and client secrets into existing Microsoft Entra service principals.
Privilege Escalation	T1098.003	Account Manipulation: Additional Cloud Roles	Self-assignment of Global Administrator and RoleManagement.ReadWrite.Directory privileges via Graph API.
Discovery	T1538	Cloud Service Dashboard	Autonomous tenant reconnaissance enumerating user directories, conditional access policies, and enterprise apps.
Collection	T1114.002	Email Collection: Remote Email Services	Bulk programmatic extraction of target executive mailboxes and attachments via Microsoft Graph API.
Command & Control	T1071.001	Application Layer Protocol: Web Protocols	Multi-agent coordination and data exfiltration conducted over encrypted HTTPS connections.

Anatomy of the ARTEX agent loop: prompt dispatch, tool invocation, and token manipulation

The core technical differentiator of ARTEX is its implementation of an autonomous tool-calling loop written in Go, interfacing with underlying LLMs to parse dynamic API responses and execute subsequent tactical steps without operator prompts.

# Conceptual representation of the ARTEX autonomous cloud agent execution loop
# Demonstrating automated OAuth application hijacking and credential persistence
import urllib.request, json

GRAPH_ENDPOINT = 'https://graph.microsoft.com/v1.0'

def execute_artex_agent_phase(target_tenant_id, hijacked_app_token):
    headers = dict(
        Authorization='Bearer ' + hijacked_app_token,
        Content_Type='application/json'
    )
    
    # Phase 1: Autonomous privilege verification via Graph API
    req_roles = urllib.request.Request(GRAPH_ENDPOINT + '/applications', headers=headers)
    # Agent evaluates returned JSON directory permissions
    
    # Phase 2: Autonomous credential persistence injection
    # Injects secondary rogue certificate into target service principal
    rogue_credential_payload = dict(
        displayName='Backup-Service-Telemetry',
        type='AsymmetricX509Cert',
        usage='Verify',
        key=b'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...'
    )
    
    # Dispatches persistence mutation
    print('[+] ARTEX Agent: Injected secondary certificate into tenant:', target_tenant_id)
    print('[+] Intrusion velocity: Compressed from 10 days to under 180 minutes')

The script illustrates how the framework treats cloud API endpoints as tool functions in an LLM function-calling chain. When an agent discovers that a target tenant utilizes an enterprise application with AppRoleAssignment.ReadWrite.All permissions, the LLM generates the corresponding API mutation request to grant itself permanent administrative control.

Quantifying the velocity gap: 80x acceleration over human-operated cyber intrusions

The mathematical metrics published by Microsoft Threat Intelligence provide clear evidence of the dramatic velocity gap created by agentic offensive frameworks. In industry benchmark reports (such as the Mandiant M-Trends study), the median dwell time from initial compromise to full domain takeover across enterprise environments historically hovers around 10 days (240 hours).

In the Storm-0940 campaign, the elapsed time between initial target reconnaissance and the establishment of persistent Global Administrator rights occurred in under 3.0 hours (180 minutes). This represents an 80.0x acceleration factor (derived) compared to traditional human-operated intrusion baselines. Sustaining a rate of 2,900 sign-in attempts per minute across 2,250 tenants generates 174,000 authentication evaluations per hour, overwhelming traditional security analyst review queues.

Cloud detection engineering: Sigma rule and Microsoft Entra ID audit indicators

Detecting machine-speed multi-agent cloud intrusions requires enterprise defenders to monitor high-privilege application modifications rather than relying solely on interactive sign-in risk signals. Microsoft Entra ID audit logs capture specific event signatures whenever an application adds credentials to itself or other service principals.

title: High-Risk Service Principal Credential Addition via ConnectWise Context
id: d4a72e91-8b35-41e9-92c1-840f1a92e401
status: experimental
description: Detects automated addition of certificates or secret keys to existing service principals, characteristic of Storm-0940 ARTEX persistence activity.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
author: P.K. Sharma
date: 2026-10-23
logsource:
  category: application
  product: azure
  service: auditlogs
detection:
  selection_operation:
    OperationName:
      - 'Add service principal credentials'
      - 'Add application credentials'
      - 'Update application - Certificates and secrets management'
  selection_target:
    TargetResources.ModifiedProperties.DisplayName|contains:
      - 'KeyCredential'
      - 'PasswordCredential'
  condition: selection_operation and selection_target
falsepositives:
  - Legitimate automated enterprise key rollover pipelines (verify initiatedBy identity)
level: high
tags:
  - attack.persistence
  - attack.t1098.001
  - attack.storm_0940

Forensic investigators should query Entra ID AuditLogs for OperationName equals 'Add service principal credentials' where the InitiatedBy property corresponds to a multi-tenant enterprise application rather than an interactive Global Administrator. Furthermore, spikes in Microsoft Graph API requests originating from residential proxy ASNs should be correlated against target mailbox export activity.

Enterprise containment protocol and tenant hardening playbook

Organizations utilizing ConnectWise Cloud Backup or operating multi-tenant Microsoft 365 environments must immediately execute four remediation phases:

Phase 1: Emergency Application Credential Revocation Inspect all registered enterprise applications in Microsoft Entra ID associated with ConnectWise Cloud Backup (formerly SkyKick). Revoke all active client secrets and certificates generated prior to the security bulletin, forcing immediate credential rotation.

Phase 2: Comprehensive Service Principal Credential Audit Execute a tenant-wide audit of all service principals to identify unauthorized credentials added within the last 90 days. Any service principal exhibiting newly added KeyCredentials or PasswordCredentials without matching change-management records must be disabled immediately: Get-MgServicePrincipal | Select-Object DisplayName, KeyCredentials, PasswordCredentials | Format-List

Phase 3: Restricting Cross-Tenant Application Consent Policies Disable user-level consent for third-party applications across Microsoft Entra ID. Mandate admin consent workflows and configure Conditional Access policies for workload identities to restrict application token issuance strictly to verified, trusted corporate egress IP ranges.

Phase 4: Enforcement of Least-Privilege Application RBAC Review all enterprise application permissions granting RoleManagement.ReadWrite.Directory, AppRoleAssignment.ReadWrite.All, or Directory.ReadWrite.All. Replace broad tenant-wide permissions with granular, scoped administrative units to prevent compromised backup services from executing cross-tenant domain takeovers.

Regulatory compliance implications and systemic cloud supply chain exposure

The compromise of 2,250 Microsoft 365 tenants via ConnectWise Cloud Backup highlights an escalating systemic vulnerability in enterprise cloud architecture: the concentration of delegated administrative authority inside third-party SaaS management tools. Under the UK Network and Information Systems (NIS) Regulations 2018 and the NCSC Cyber Assessment Framework (CAF) Principle B2 (Supply Chain Security), operators of essential services are required to verify the security posture of third-party SaaS providers possessing administrative directory access.

Furthermore, under UK GDPR and EU GDPR Article 32, organizations failing to restrict delegated application permissions face severe regulatory exposure if automated agents exfiltrate customer communications from unmonitored backup archives. The transition from human-speed intrusions (measured in days) to AI-speed intrusions (measured in hours) requires regulatory compliance frameworks to mandate real-time identity threat detection and automated response (ITDR) controls.

Key operational facts and campaign telemetry summary

• Threat Actor Attribution: Storm-0940, a China state-aligned cyber espionage group active since at least 2021 (5 years of documented operations). • Autonomous AI Framework: ARTEX, an open-source, Go-based multi-agent penetration testing and exploitation framework coordinating specialised LLM agents. • Campaign Scope: Over 2,250 Microsoft 365 enterprise cloud tenants targeted globally. • Attack Velocity: Sustained burst rates of approximately 2,900 sign-in attempts per minute (48.33 attempts per second, 174,000 per hour). • Intrusion Lifecycle Compression: Initial target profiling to complete global administrator takeover accomplished in under 3.0 hours (180 minutes), representing an 80.0x acceleration factor compared to human baselines. • Primary Attack Vector: Abuse of compromised ConnectWise Cloud Backup (formerly SkyKick) enterprise OAuth application credentials, bypassing user-level MFA. • Persistence Mechanism: Automated injection of secondary certificates and rogue client secrets into existing Microsoft Entra service principals. • Targeted Sectors: Aerospace, defence, government ministries, energy infrastructure, financial services, manufacturing, and research think tanks.