Storm-0940 and ARTEX: How AI Agents Turned a ConnectWise Credential Into 2,250 Tenant Attacks

Microsoft says an AI agent framework turned one stolen vendor credential into attempts against more than 2,250 tenants. In a report published October 21, 2026, Microsoft Threat Intelligence assesses that Storm-0940, a China-state aligned actor, was responsible for the ConnectWise Cloud Backup compromise and used ARTEX, an agentic penetration-testing framework, to sign in to downstream Microsoft 365 tenants, map them and plant persistence. In several cases less than three hours passed between initial targeting and privileged access. This is the same tool CrowdStrike tied to attacks on South Korean banks, now used in a supply-chain attack. If you used ConnectWise Cloud Backup or any multi-tenant app with broad Graph permissions, check your tenant.

What Microsoft reports, step by step

The chain below follows Microsoft's report. Microsoft states that the activity did not result from a compromise of, or a vulnerability in, its own systems.

1. Background tradecraft and the spray

Storm-0940, active since 2021, has historically used password spraying, exploited internet-facing apps and moved laterally with compromised accounts. It has also added credentials to existing OAuth apps to persist in Microsoft 365. Between October 10 and 14, infrastructure at 144.172.64.99 sprayed 327 accounts at eight organizations, generating more than 151,000 failed logons, peaking at 2,900 failures a minute on October 11. Microsoft observed no successful authentication, token issuance, Graph call or directory change in that phase.

2. The supply-chain compromise

The actor gained control of identities for several ConnectWise cloud applications, including Cloud Backup. Public reports surfaced on October 15 and ConnectWise published an advisory on October 16 that linked one IP address to the earlier spray infrastructure. Our supply-chain tracker records that ConnectWise disabled seven application identities on October 17 and suspended the service, with Huntress confirming unauthorized sign-ins in 162 tenants by October 16.

3. Agents take over at machine speed

With the stolen application credentials, ARTEX agents signed in to downstream tenants without any interactive user. Microsoft says the framework accelerated scanning, reconnaissance, spraying and OAuth abuse to machine speed: more than 2,250 tenants were targeted at 2,900 sign-in attempts a minute, and one figure shows over 200 sign-ins in under four minutes using four application credentials. Microsoft notes that most of the targeting was unsuccessful.

4. Persistence through Microsoft Graph

In affected environments, the agents did reconnaissance, changed application credentials to establish persistence, and altered identities, groups and privileged roles. One ConnectWise management application reportedly self-assigned the Global Administrator role. Microsoft warns that credentials added to an app or service principal can remain a backdoor after the original ConnectWise app is disabled, and that the presence of an affected app or a successful sign-in does not by itself prove data access.

What ARTEX is

Microsoft describes ARTEX as an open-source, multi-agent LLM penetration-testing framework written in Go with a Next.js front end that can use any AI model. It runs tests from reconnaissance through data exfiltration with little human input and builds a graph of discovered assets and weaknesses. The interface supports English, Korean, Mandarin, Spanish and Japanese, and Microsoft says multiple actors across regions have used it.

Wiz published a companion write-up on the same infrastructure. According to Wiz, ARTEX appeared on GitHub in July 2026, won Baidu's "Agent+" red team challenge in September, and was made closed-source on October 8 after more than 12,000 forks. Wiz saw a planner agent choosing steps, worker agents running tools such as nmap, curl and Impacket, and results feeding a shared asset graph. Its observed playbook against IT and software vendors included downloading JavaScript bundles, source maps and OpenAPI docs, manipulating OAuth callback and state parameters, testing unsigned JWTs against SSO routes, password spraying Okta and Entra, abusing account-recovery endpoints, and probing tenant isolation with disposable registrations. Neither source names the models behind the agents.

Wiz lists four signs that the traffic was agentic: steps chained automatically, each using the previous step's output, automatic adaptation to rate limits and IP blocks, and tactics a skilled human would skip, such as generic payloads against heavily scrutinized Microsoft OAuth flows. Some sessions ran 24 to 30 hours. Earlier posts cover the South Korea bank campaign and how Wiz described AI-driven cloud attacks. The Hacker News also covered the attribution.

What this means if you run AI coding agents

Coding agents are not the target here, but the incident touches the same trust model: a long-lived credential held by something automated. A few practical points follow.

1. Audit app permissions. Apply least privilege to multi-tenant apps and consent grants, and monitor credential additions, privilege assignments and anomalous app-only activity, as Microsoft advises.
2. Search by application ID, not display name, in every tenant where an affected app was ever installed. Microsoft notes the post mentions four application IDs while its queries list three, so confirm the full list against ConnectWise's advisory.
3. Preserve evidence before you delete. Do not remove enterprise apps first. Keep Entra sign-in and audit logs, Purview audit data, SIEM data and Graph telemetry.
4. Review from October 1 where logs allow (hunting from October 13 for sign-ins), covering service principal sign-ins including failures, credential additions, new owners, app-role and consent grants, privileged role changes and Conditional Access changes. Also review mail and file access and forwarding rules.
5. Rotate after preserving. Revoke unnecessary permissions and rotate credentials on confirmed suspicious activity, then confirm that vendor rotation and tenant remediation removed every unauthorized path.
6. Treat IP indicators as a starting point. Microsoft lists 144.172.64.128, 144.172.64.99 and 144.172.64.60 plus VPN-associated addresses and user agents such as python-requests 2.34.2 and curl/7.88.1. Wiz warns many user agents are not unique to this actor and are noisy if hunted alone.

Microsoft's detections include Defender XDR alerts for unusual Graph activity from the ConnectWise app and Global Administrator self-assignment, and Defender for Cloud Apps alerts for suspicious app role assignments and high-volume mail access by OAuth apps. Wiz points to existing password-spray detection rules for Okta and Entra.

Timeline at a glance

• September 2026: earliest ARTEX-driven activity Microsoft describes; ARTEX artifacts also appear in late-September attacks on South Korean banks, according to Wiz.
• October 8: the ARTEX developer makes the project closed-source (Wiz).
• October 10 to 14: the password-spray campaign against 327 accounts, peaking October 11.
• October 13: Microsoft's suggested start for hunting queries.
• October 15: public reports of the ConnectWise compromise.
• October 16: ConnectWise's initial advisory, later expanded.
• October 21: Microsoft publishes its Storm-0940 report.

Closing the source did not remove the capability. Forks already exist, and Microsoft notes that more than one actor in more than one region has used the framework. Defenders should assume the technique outlives any single tool release, and that "open-source pentest framework" and "attacker tooling" are now the same thing for planning purposes.

The machine-speed lesson

The credential was stolen the ordinary way. What changed is what happened next. The same weak point that a human operator would work through over days was probed across thousands of tenants in minutes, with the agent adapting to blocks. That compresses the window between exposure and remediation, which is why Microsoft's emphasis on evidence-first, fast and complete rotation matters. It also connects to our earlier coverage of PHP2Shell and exploit speed with agents: the defender's advantage is shrinking when remediation depends on a human noticing.

There are limits to what we can say. Microsoft's attribution is an assessment, not a court finding. Public numbers differ by source: Huntress counted 162 tenants and The Hacker News reported 173 for confirmed unauthorized sign-ins, while Microsoft's 2,250 figure counts tenants targeted, not compromised. Treat the larger number as exposure, not as victims.

What Beam can and cannot do here

Beam does not apply directly. It watches what coding agents such as Claude Code and Codex do on your machine, flags credential exposure and destructive commands, and scans skills and MCP configs before you run them, all on-device. It does not read Entra, Microsoft 365 or Graph logs, and it cannot detect an OAuth backdoor. Use Defender, Sentinel or your SIEM for this incident. If you keep tenant admin credentials or app secrets where an agent can read them, Beam's credential-exposure flags are one way to notice that; see how it works.

Frequently asked questions

What did Microsoft say Storm-0940 did?

Microsoft assesses that Storm-0940, a China-state aligned actor, gained control of ConnectWise cloud application identities and used the ARTEX agent framework to sign in to downstream tenants, run reconnaissance and establish persistence at machine speed.

What is ARTEX?

ARTEX is a multi-agent LLM penetration testing framework written in Go that can use any AI model. It was open source, was linked earlier to attacks on South Korean banks, and was made closed-source on October 8, 2026 according to Wiz.

How big was the activity?

Microsoft reports more than 2,250 tenants targeted at 2,900 sign-in attempts per minute, plus a separate October 10 to 14 spray of 327 accounts at eight organizations that produced over 151,000 failures and no successful authentication.

What should I check in my own tenant?

Search every tenant for the affected ConnectWise application IDs, review service principal sign-ins and Graph activity from October 1, and look for credential additions, new owners, consent grants and privileged role changes before deleting anything.

Does this affect people who run coding agents?

Not directly. It targets Microsoft 365 and Entra tenants. It matters because it shows agentic tooling compressing attack time, which raises the cost of slow credential rotation and broad app permissions.

Can Beam detect this?

No. Beam watches coding agents on your machine and scans skills and MCP configs. It does not read Entra or Microsoft 365 logs, so use Microsoft Defender, Sentinel or your SIEM for this incident.

Related reading

• October 2026 software supply-chain incidents tracker
• South Korea bank hack: ARTEX and Claude Code sessions
• Anatomy of an AI-driven cloud attack
• PHP2Shell and AI agents: exploit speed
• Microsoft's report

Details reflect Microsoft's and Wiz's published reports as of October 22, 2026 and may change as ConnectWise and Microsoft update their guidance. Beam is a local prototype; features described are as documented at the time of writing.