Cloud intrusions moved from initial targeting to privileged access in less than three hours in some attacks attributed to China-aligned Storm-0940. The group used the ARTEX AI penetration-testing framework and stolen ConnectWise Cloud Backup credentials to target Microsoft 365 environments. Activity reached 2,900 sign-in attempts per minute, although most targeting was unsuccessful.
What Happened
Microsoft attributed a recent ConnectWise supply-chain compromise to Storm-0940, a Chinese government-aligned group active since 2021. The group has historically targeted internet-facing applications and compromised accounts for data theft. Since September, it has targeted organizations across government, aerospace, defense, finance, manufacturing, technology, and energy.
The campaign used ARTEX, an AI-driven penetration-testing framework that can coordinate multiple agents across offensive tasks. ARTEX was released as an open-source project earlier in the year and could work with different AI models. Its developer said the project was intended for authorized security testing, denied responsibility for criminal use, and later moved it to closed source after reports of abuse.
Before obtaining the ConnectWise credentials, the attackers used broad password spraying and sustained high-volume authentication attempts. One account of the activity recorded more than 151,000 failed attempts against 327 accounts at eight organizations between October 10 and 14. Activity peaked at 2,900 failed attempts per minute on October 11. Another account reported more than 111,000 failed log-on attempts that day. The majority of the targeting was unsuccessful.
The attack changed once the group obtained credentials belonging to ConnectWise cloud application accounts. ConnectWise Cloud Backup is designed to protect data in Microsoft 365 and Google Workspace, and its applications had already been granted access inside customer environments. ARTEX agents used those valid application credentials to authenticate to Microsoft 365 tenants without requiring an interactive user sign-in.
In environments where authentication succeeded, the agents performed directory reconnaissance through Microsoft Graph, modified application credentials to establish persistence, and attempted changes involving identities, groups, and privileged roles. In several attacks, the time from initial targeting to privileged cloud access was less than three hours. Microsoft said Storm-0940 achieved privileged cloud persistence at many organizations despite most targeting being unsuccessful.
Why It Matters
The campaign combined three forms of leverage: trusted third-party software, valid cloud application credentials, and automated agents. Each element reduced friction for the attacker. The compromised applications already had customer-granted permissions, so successful activity did not depend on persuading an individual user to complete an interactive sign-in.
The speed matters operationally. At 2,900 sign-in attempts per minute, a team relying on manual review cannot assess each event before the next wave arrives. AI agents can continue operating around the clock and pursue several paths at the same time. In this case, automation accelerated familiar actions such as password spraying, authentication, reconnaissance, credential changes, and privilege expansion.
Persistence is a particular concern. Disabling the original ConnectWise connection may not be enough if an attacker already added a new credential to a trusted application. That credential can remain as a separate route into the environment after the initial application access is remediated.
The campaign does not show that every target was breached. Most attempts failed, and lockout responses represented nearly 98% of the observed activity in one analysis. The security significance comes from the speed and scale of attempts, combined with successful privileged access and persistence in multiple environments.
What to Watch
Organizations should watch for additional findings about which ConnectWise customers and cloud tenants experienced successful follow-on activity. High authentication volume alone does not establish compromise, so the decisive evidence will be valid application sign-ins, directory reconnaissance, credential additions, and changes to identities or privileged roles.
Previously added service-principal credentials deserve continued attention. The available guidance identifies October 1 as the starting point for reviewing additions, which predates public disclosure of the ConnectWise incident. If suspicious credentials remain active, disabling the original connection may not close the attacker’s access.
ARTEX is no longer being maintained as a public open-source project, but existing copies remain available to anyone who already obtained them. Other threat actors in several regions have reportedly used the framework. Defenders should therefore treat this as a broader change in operating speed rather than a tool risk limited to one campaign.
Future incidents may show whether agent-based activity can consistently turn broad targeting into successful access. For now, the evidence supports faster execution and parallel attempts, not universal success.
What Defenders Should Do
Application containment: Identify ConnectWise Cloud Backup applications and credentials associated with the incident, revoke affected access, and confirm that remediation reached every connected Microsoft 365 environment. Do not assume disabling one integration removes credentials created after access was obtained.
Persistence review: Examine service-principal credential additions dating back to at least October 1. Investigate unexpected application secrets, certificates, or other credentials, especially when they were added near suspicious authentication or Microsoft Graph activity. Remove unauthorized credentials and verify the remaining application owners and permissions.
Identity investigation: Review non-interactive application sign-ins, failed authentication bursts, password-spraying patterns, directory reconnaissance, and attempted changes to users, groups, and privileged roles. Separate noisy failed attempts from successful authentication and follow-on actions so high volume does not hide a smaller number of important events.
Response automation: Configure detection and containment paths that can operate at machine speed. The observed rate of 2,900 attempts per minute leaves little room for workflows that depend entirely on a person noticing an alert, gathering context, and manually revoking access. Automation should surface successful transitions, such as a valid application login followed by reconnaissance or credential modification.
Permission review: Reassess the access granted to backup and other multi-tenant cloud applications. Trusted software can become an attacker’s route into customer environments when its credentials are stolen. Limit application permissions to what the service requires and ensure changes to credentials and privileged access generate reviewable events.
Executive readiness: Update incident-response assumptions about attacker speed. Escalation, third-party contact, identity containment, and customer-impact decisions may need to occur within hours rather than days when autonomous agents can pursue multiple intrusion paths simultaneously.
The Larger Lesson
Agentic AI is increasing the tempo and scale of existing attack methods. The campaign still depended on recognizable techniques: password spraying, stolen credentials, trusted applications, reconnaissance, persistence, and privilege changes. AI made those steps faster and allowed more paths to run in parallel.
That distinction matters because defenders do not need an entirely new security model, but they do need faster execution of the existing one. Strong application identity controls, limited permissions, service-principal monitoring, automated containment, and rapid third-party response become more important when the attacker can move from target selection to privileged access in less than three hours.