Key Takeaway:
- Microsoft linked Storm-0940 to AI-driven attacks tied to the ConnectWise Supply Chain Breach.
- Attackers used an open-source AI framework to gain cloud access across organizations in under 3 hours.
- Microsoft advised affected customers to review application credentials and follow containment guidance.
Microsoft says China-aligned threat actor Storm-0940 used agentic artificial intelligence to automate cyberattacks against hundreds of organizations worldwide, accelerating the ConnectWise supply chain breach in September and October 2026.
AI tool accelerates attacks across organizations
In a security report published Oct. 21, Microsoft said Storm-0940 used ARTEX, an open-source artificial intelligence penetration-testing framework, to automate reconnaissance, password attacks and the misuse of trusted applications. The campaign targeted organizations across industries, including financial services, government, energy, manufacturing and technology.
Microsoft said several attacks gave the threat actor privileged access to victims’ cloud infrastructure in less than three hours. The ConnectWise Supply Chain Breach showed how automated tools help attackers target multiple organizations and attack methods simultaneously.
“Storm-0940’s use of ARTEX accelerated the speed of compromised application abuse to authenticate to Microsoft 365 customer environments through applications that had already been granted access,” Microsoft said in its report.
The activity allowed attackers to use existing application permissions without requiring an interactive user sign-in. Microsoft said the campaign did not result from a breach or vulnerability in its own corporate systems, products or services.
Connectwise supply chain breach exposes trusted cloud applications
Microsoft linked Storm-0940 to a supply chain compromise involving ConnectWise, a provider of technology management and cloud backup services. The company’s initial advisory, published Oct. 16, described unauthorized access associated with its Cloud Backup application.
Microsoft identified suspicious activity involving the same internet protocol address range used in an earlier password-spraying campaign. Password spraying involves trying commonly used passwords against multiple accounts to gain access.
Between Oct. 10 and 14, Microsoft recorded more than 151,000 failed sign-in attempts targeting 327 accounts across eight organizations. The activity peaked at 2,900 failed attempts per minute on Oct. 11. Microsoft said it observed no successful authentication, token issuance, Microsoft Graph calls or directory changes during that password-spraying campaign.
Following the ConnectWise compromise, attackers used compromised application credentials to attempt access to more than 2,250 customer tenants, with activity reaching 2,900 sign-in attempts per minute, according to Microsoft.
In several affected environments, Microsoft observed follow-on activity through Microsoft Graph, a service that allows applications to interact with Microsoft 365 data and resources. The activity included reconnaissance, changes to application credentials and attempts to modify privileges that could enable continued access.
Microsoft cautioned that the presence of an affected application or evidence of successful authentication does not, by itself, prove that attackers accessed or stole customer data.
Microsoft urges customers to review access
Microsoft urged organizations using affected ConnectWise applications to review application sign-ins, permissions and changes to account credentials. It also advised customers to preserve investigation records and follow ConnectWise’s containment guidance.
The company recommended checking for unfamiliar application credentials, new privileged roles and unexpected changes to users, groups or access permissions. Organizations should also review Microsoft 365 activity for unusual email access, file downloads and other suspicious actions.
ConnectWise’s published guidance remains important for customers assessing exposure and restoring affected services. Microsoft advised organizations to keep affected application connections disabled until the vendor provides formal restoration instructions.
The incident highlights the risks posed by compromised third-party applications that hold permissions inside customer environments. By combining stolen application credentials with AI-driven automation, attackers can move quickly across multiple organizations, leaving defenders less time to investigate and restrict access.
