Affected Systems

ConnectWise multi-tenant application compromised; downstream victims across Microsoft 365 environments in aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and non-profit sectors globally. Storm-0940 achieved privileged access in under 3 hours in multiple cases using ARTEX agentic AI framework for automated password spraying, reconnaissance, and OAuth application abuse.

Exploitation Status

Active exploitation confirmed since September 2026. Storm-0940 successfully compromised ConnectWise supply chain and achieved privileged cloud access at multiple organizations. ARTEX is an open-source framework publicly available and observed in use by multiple threat actors across geographic regions. Public reporting from October 2026 confirms use in Korean financial institution breaches.

Business Impact

Nation-state actor achieved privileged Microsoft 365 access in under 3 hours at multiple organizations via compromised ConnectWise application credentials. AI-driven automation enables 24/7 simultaneous attacks across hundreds of targets with minimal human interaction. Threat actor conducted reconnaissance via Microsoft Graph, modified application credentials, and attempted privilege escalation for persistent access. While authentication events confirmed, data exfiltration not verified in all affected environments. Defender response time severely compressed due to attack speed.

Urgency

🔴 Immediate

Recommended Actions

  • Review all service principal sign-ins in Azure AD/Entra ID for unexpected authentication patterns, especially from ConnectWise applications, focusing on activity since September 2026
  • Audit OAuth application credentials and privilege changes in Microsoft 365 environments; revoke and rotate credentials for any ConnectWise-related service principals per ConnectWise containment guidance published October 16, 2026
  • Deploy Microsoft Defender XDR detections for suspicious Microsoft Graph activity and Storm-0940 threat infrastructure; enable hunting queries for AI-accelerated reconnaissance patterns and rapid credential modification
  • Implement conditional access policies requiring interactive user sign-in for high-privilege operations; restrict application-only authentication for sensitive Microsoft Graph API calls
  • Monitor for high-volume authentication attempts, password spray patterns, and compressed attack timelines (initial access to privilege escalation under 3 hours); preserve logs for forensic investigation

---

# Threat Actor Context

Actor Profile

Storm-0940 is a China-state aligned threat actor active since 2021, with no known industry aliases. The group conducts espionage operations focused on data theft across multiple industries globally. Storm-0940 has evolved from traditional intrusion methods to integrating agentic AI frameworks into offensive workflows, enabling exponential scaling of operations. The actor's motivation aligns with nation-state intelligence collection objectives, targeting strategic sectors including aerospace, defense, government, military, semiconductor, and technology organizations.

TTPs (Tactics, Techniques, Procedures)

Storm-0940 employs a multi-stage attack chain combining traditional and AI-accelerated techniques. Initial access is achieved via password spraying (T1110.003) and exploitation of internet-facing applications (T1190). The actor leverages compromised accounts for lateral movement and establishes cloud persistence through OAuth application credential manipulation (T1098.001, T1528). Post-compromise activity includes reconnaissance via Microsoft Graph API (T1087, T1069), application credential modification, and privilege escalation attempts (T1078.004). The integration of the ARTEX agentic AI framework automates scanning, reconnaissance, password spraying, and OAuth abuse workflows, compressing attack timelines from initial targeting to privileged access to under 3 hours in multiple instances. Data exfiltration occurs through Microsoft Graph access to email and cloud resources (T1114.002, T1530).

Targets & Patterns

Storm-0940 demonstrates broad targeting across strategic sectors: aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software/SaaS, IT services, technology, and think tanks/non-profits. The actor's target selection reflects intelligence collection priorities aligned with Chinese state interests, particularly focusing on critical infrastructure, defense industrial base, and technology sectors. The ConnectWise supply chain compromise enabled downstream targeting of hundreds of organizations globally through multi-tenant application abuse. Geographic focus spans multiple regions, with particular emphasis on organizations with strategic technology, defense, or policy relevance. The use of ARTEX allows the actor to scale operations exponentially, attempting simultaneous breach paths across numerous targets without human resource constraints.

Historical Context

Storm-0940 has operated continuously since 2021, initially relying on conventional intrusion techniques including password spraying and internet-facing application exploitation. The actor has consistently targeted cloud environments, establishing persistence through OAuth application manipulation to maintain access to Microsoft 365 resources. Beginning in September 2026, Storm-0940 adopted the ARTEX agentic AI penetration testing framework, marking a significant evolution in operational capability. This integration represents one of the first observed instances of a nation-state actor operationalizing agentic AI for large-scale offensive operations. The ConnectWise supply chain compromise, disclosed in October 2026, demonstrates the actor's shift toward supply chain attack vectors to achieve broad downstream access. This activity aligns with broader trends of threat actors across multiple geographic regions adopting the ARTEX framework following its public availability.

Defensive Recommendations

  • Monitor service principal and OAuth application sign-in logs for anomalous authentication patterns, particularly non-interactive sign-ins and application credential usage outside normal baselines (T1078.004)
  • Implement alerting for rapid-sequence Microsoft Graph API calls indicative of automated reconnaissance, including enumeration of users, groups, and mailbox access attempts (T1087, T1114.002)
  • Audit OAuth application permissions regularly and investigate unexpected application credential additions or privilege modifications, particularly for applications with Mail.Read, Mail.ReadWrite, or Directory.ReadWrite.All permissions (T1098.001)
  • Deploy rate-limiting and conditional access policies to restrict password spray attempts and enforce MFA for all user and service principal authentication, with particular attention to legacy authentication protocols
  • Enable Microsoft Defender XDR detections for suspicious Microsoft Graph activity and correlate high-volume authentication attempts with known Storm-0940 infrastructure; preserve logs for forensic investigation and follow ConnectWise containment guidance for affected environments