A Stolen ConnectWise Credential Let an AI Agent Try 2,250 Microsoft 365 Tenants

There is no CVE here, and that's the point: nothing in Microsoft 365 or Graph had to be vulnerable for this to work. A threat actor Microsoft calls Storm-0940 stole a credential belonging to a trusted multi-tenant application — ConnectWise Cloud Backup — and authenticated as that application directly, inheriting every Graph permission customers had already granted it, no interactive sign-in required. What made this one different from the usual stolen-OAuth-token story is speed: Microsoft says the actor ran an open-source agentic framework called ARTEX to automate reconnaissance and OAuth abuse across thousands of downstream tenants, reaching privileged cloud access in under three hours in some cases. Two incident-response firms who watched the same traffic, Expel and Huntress, are more cautious than Microsoft's attribution write-up: a shared IP address proves the activity is connected, not that ARTEX specifically drove it.

What actually broke

ConnectWise's Cloud Backup app (formerly SkyKick Cloud Backup for Microsoft 365) is a multi-tenant application: once a customer grants it Graph permissions, it can act on that tenant's behalf without a human signing in again. Storm-0940 didn't exploit a flaw in that design — it stole the application's own credential and used it exactly as intended, just without ConnectWise's consent. Because Microsoft Graph already trusted the app, the stolen credential inherited whatever permissions customers had granted, including, in at least two tenants per independent researchers, enough to self-assign the Global Administrator role.

The attack chain

What ARTEX is

ARTEX is an open-source, multi-agent penetration-testing framework (written in Go with a Next.js frontend) that connects to external LLMs — Zscaler researchers found instances configured against DeepSeek, GLM and Grok through OpenAI-compatible gateways — to automate reconnaissance through exfiltration with little human input. It isn't exclusive to Storm-0940: the same framework has separately been tied to breaches at South Korean financial institutions this year, attributed by CrowdStrike to an unrelated, financially-motivated individual rather than a nation-state actor. Different operators, different motives, same off-the-shelf tool — worth remembering before treating every ARTEX sighting as the same threat.

Containment timeline

Who Storm-0940 is

• China state-aligned; active since at least 2021; no known industry aliases
• Historically gains initial access via password spraying and exploiting internet-facing apps
• Persists by adding credentials to existing OAuth applications rather than planting new malware
• Per Microsoft's broader research cited in ConnectWise's advisory, has targeted aerospace and defense, energy, financial services, government, legal, manufacturing, semiconductors and technology sectors

What to do

1. Disable any ConnectWise Cloud Backup, Cloud Management, or legacy SkyKick application connections — but preserve logs and evidence before deleting or modifying anything.
2. Inventory the App IDs above across your tenants even if the integration is no longer actively used.
3. Review Entra ID sign-in and audit logs, Purview audit records, and SIEM data from at least October 15, 2026, extending back to October 1 if available.
4. Watch for Defender alerts such as an application self-assigning the Global Administrator role, or sign-ins from verified nation-state threat-actor infrastructure.
5. Search hunting queries by application ID rather than display name — compromised apps can be renamed.

Data as of October 25, 2026

Sources: Microsoft Threat Intelligence — Storm-0940 uses ARTEX agentic AI in ConnectWise supply chain compromise, ConnectWise Trust Center advisories.