CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Storm-0940

actor · actor:storm-0940

Microsoft's designation for a China-state aligned actor active since 2021 that targets organizations across many industries for data theft, historically through password spraying and exploitation of internet-facing applications, and persists by adding credentials to existing OAuth applications; Microsoft reports it has used the ARTEX framework against hundreds of organizations since at least September 2026 and assesses it was responsible for the ConnectWise Cloud Backup compromise (Microsoft Threat Intelligence, 2026-10-21).

Coverage
2
first 2026-10-18 → last 2026-10-22
Latest activity
2026-10-22
ConnectWise SkyKick app credential used in 162+ Microsoft 365 tenants; disabling it does not undo planted…
Peak priority
high
1 high · 1 notable
Targets
technology
sectors: technology, public-sector
Sources cited
11
11 hosts
2026-10-182 appearances2026-10-22

Action items (4)

Do-now tasks recorded on the entries about Storm-0940, newest first. Check the date before acting on an older one.

  • In every Entra tenant you or your MSP administer, disable without deleting the seven ConnectWise application identities that ConnectWise lists by client ID (Cloud Backup is 506e08f9-6e9a-4da4-942b-a099a03644ae; the other six are in ConnectWise's advisory), dormant connections included, and keep them disabled until ConnectWise gives restoration instructions; where Graph activity logs were enabled, review them for these apps until at least 90 minutes after you disabled them, because a token issued before the disable stays valid for up to 90 minutes, and preserve the sign-in and audit logs promptly without delaying containment, because Entra ID Free keeps only 7 days.
    2026-10-18ConnectWise SkyKick app credential used in 162+…
  • In the same tenants list the apps owned by the ConnectWise S-K LLC tenant (3f9cd7a0-127a-4ed4-bf06-2f830d5616b7), and disable each that you do not use or cannot verify as safe.
    2026-10-18ConnectWise SkyKick app credential used in 162+…
  • In the same tenants review every enterprise application and app registration, MSP management and security tools first but none skipped (Huntress saw the secrets planted on apparently random applications, in one tenant on some of the least privileged ones), for client secrets, certificates and federated credentials added since 2026-10-13 and remove any you did not create; also check the directory roles, owners and consent grants held by ConnectWise and SkyKick service principals, Conditional Access exclusions for them, and mailbox forwarding, inbox and transport rules and delegated access, because disabling the vendor applications does not remove access planted through them.
    2026-10-18ConnectWise SkyKick app credential used in 162+…
  • In every Okta org that allows self-service registration, review the accounts created since 2026-10-13 and every Okta Verify enrollment on them, and remove self-created accounts that nobody provisioned.
    2026-10-22Microsoft: Storm-0940 runs the ARTEX agent…

Defender insights

What each entry about Storm-0940 tells a defender to do, newest first.

2026-10-18HIGHexploitedConnectWise SkyKick app credential used in 162+ Microsoft 365 tenants; disabling it does not undo planted access

Exposure · triage · detection

2026-10-22NOTABLEMicrosoft: Storm-0940 runs the ARTEX agent framework at machine speed; Expel adds an Okta self-registration technique

Exposure · triage · detection

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

uses

attributed activity

Story timeline

  1. 2026-10-22ARTEX: Microsoft reports Storm-0940, a China-state aligned actor, running an open-source multi-agent LLM penetration-testing framework against hundreds of organizations, with privileged cloud access in under three hours in some cases, and Expel sees the same infrastructure abuse Okta self-service registration
    active-threatsMicrosoft: Storm-0940 runs the ARTEX agent framework at machine speed; Expel adds an Okta self-registration technique
  2. 2026-10-18ConnectWise Cloud Backup (formerly SkyKick): the vendor's Microsoft 365 application credential was used to sign in to customer tenants, with directory-role self-assignments in about 50 tenants and, Huntress reports, added credentials in two
    active-threatsConnectWise SkyKick app credential used in 162+ Microsoft 365 tenants; disabling it does not undo planted access

Hunting pivots

Affected products
Microsoft Entra ID ×2ConnectWise Cloud BackupConnectWise Cloud ManagementOkta
Tags
cloud ×2identity ×2actively-exploitedai-abusechina-nexusespionagenation-statesupply-chain
ATT&CK techniques (10 across 8 tactics)

10 techniques observed across 2 entries about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • ReconnaissanceActive Scanning
  • Resource DevelopmentObtain Capabilities: Artificial Intelligence
  • Initial AccessValid Accounts: Cloud Accounts · Trusted Relationship
  • PersistenceValid Accounts: Cloud Accounts · Account Manipulation: Additional Cloud Credentials · Account Manipulation: Additional Cloud Roles · Account Manipulation: Device Registration · Create Account: Cloud Account
  • Privilege EscalationValid Accounts: Cloud Accounts · Account Manipulation: Additional Cloud Credentials · Account Manipulation: Additional Cloud Roles · Account Manipulation: Device Registration
  • StealthValid Accounts: Cloud Accounts
  • Credential AccessBrute Force: Password Spraying
  • DiscoveryAccount Discovery: Cloud Account

Reconnaissance TA0043

T1595Active Scanning×1

Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

Resource Development TA0042

T1588.007Obtain Capabilities: Artificial Intelligence×1

Adversaries may obtain access to generative artificial intelligence (AI) tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including creating scripts, assisting social engineering, developing payloads, and to Query Public AI Services in support of Reconnaissance.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

Initial Access TA0001

T1078.004Valid Accounts: Cloud Accounts×2

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

T1199Trusted Relationship×1

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Evidence: 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

Persistence TA0003

T1078.004Valid Accounts: Cloud Accounts×2

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

T1098.001Account Manipulation: Additional Cloud Credentials×2

Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

T1098.003Account Manipulation: Additional Cloud Roles×2

An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments. With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

T1098.005Account Manipulation: Device Registration×1

Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1136.003Create Account: Cloud Account×1

Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

Privilege Escalation TA0004

T1078.004Valid Accounts: Cloud Accounts×2

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

T1098.001Account Manipulation: Additional Cloud Credentials×2

Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

T1098.003Account Manipulation: Additional Cloud Roles×2

An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments. With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

T1098.005Account Manipulation: Device Registration×1

Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

Stealth TA0005

T1078.004Valid Accounts: Cloud Accounts×2

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

Credential Access TA0006

T1110.003Brute Force: Password Spraying×2

Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

Discovery TA0007

T1087.004Account Discovery: Cloud Account×1

Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

Entries about Storm-0940 (2)

2026-10-18 · view entry permalink →

HIGHexploitedupdatedNATOA1

ConnectWise Cloud Backup (formerly SkyKick): the vendor's Microsoft 365 application credential was used to sign in to customer tenants, with directory-role self-assignments in about 50 tenants and, Huntress reports, added credentials in two

ConnectWise says it identified unauthorized access to application identities within its Cloud Backup (formerly SkyKick) environment; on 2026-10-17 it disabled seven application identities, suspended the service, says the shared Cloud Backup credentials are no longer valid, and warns that disabling does not reverse changes already made in a tenant (ConnectWise, 2026-10-19). As of ConnectWise's update of 2026-10-19 01:15 UTC, Cloud Backup, SaaS Security and Cloud Management remained suspended with no confirmed restoration time, which also took ConnectWise's SaaS Security monitoring and alerting out of service (ConnectWise, 2026-10-19), and heise reports on 2026-10-21 that ConnectWise has since begun restoring the services step by step over several days (heise online, 2026-10-21); ConnectWise reports no successful threat activity in the environments it monitors since it implemented mitigations (ConnectWise, 2026-10-19) and says it cannot independently determine whether a given partner or customer tenant was affected (ConnectWise, 2026-10-19). Huntress and Todyl report that on 2026-10-15 the app's identity signed in to customer Microsoft 365 tenants from one hosting-provider address and received app-only Microsoft Graph tokens; the credential sits in the vendor's own tenant, so no user, MFA prompt or user Conditional Access was involved, and the app's consent covers read and write access to mail, files and Teams chats (Huntress, 2026-10-16; Todyl, 2026-10-15). Huntress confirmed unauthorized sign-ins in 162 tenants by 2026-10-16 and later counted almost 1,000 tenants with sign-in activity from that address, over 300 successful, after password spraying against four law-firm tenants on 13 and 14 October, and a separate failed wave targeted 16 tenants in policy and national-security sectors (Huntress, 2026-10-16). In about 50 of its tenants, ConnectWise Cloud Management apps assigned themselves directory roles, mostly Exchange Administrator; in one the Teams app added itself to Global Administrator and client secrets were added to an MSP management application and to Huntress's own application within about five minutes, the credential additions from private Azure space (Huntress, 2026-10-16). Huntress later identified a second tenant with the same sequence, the application granting itself Global Administrator and then planting a new secret on a small number of other applications, within two minutes of the first around 03:45 UTC on 2026-10-15, with the choice of applications apparently random (Huntress, 2026-10-16). It says the unauthorized sign-ins with the credential were bunched across the morning of 2026-10-15 UTC, that the last successful one it observed was at 08:44 UTC that day with only failed attempts afterwards in the tenants where it can read sign-in logs, and that in the two tenants it reviewed it found no mailbox or file manipulation and no user or policy changes (Huntress, 2026-10-16). Microsoft Threat Intelligence, as BleepingComputer relays it, called it an active supply-chain attack and assessed likely abuse of existing permissions including Directory.ReadWrite.All (BleepingComputer, 2026-10-17). Microsoft Threat Intelligence later assessed that Storm-0940, a China-state aligned actor, was responsible, using the ARTEX agentic-AI framework to attempt sign-ins to more than 2,250 tenants (Microsoft, 2026-10-21). How the credential was obtained and what was read remain unknown (ConnectWise, 2026-10-19; BleepingComputer, 2026-10-17).

Triage: the vendor's apps sign in from Azure addresses with a .NET SDK user agent, while the credential additions used a Python user agent; Python and curl are common in administration, so Huntress says the combination of actor, operation and user agent is the signal (Huntress, 2026-10-16). Role self-assignments carrying the vendor's own user agent are not proven benign, since Huntress has not confirmed vendor automation (Huntress, 2026-10-16).

We recently identified unauthorized access to application identities within the ConnectWise Cloud Backup environment.

Disabling the affected connections prevents new authentication through those connections; it does not reverse changes previously made inside a tenant.

Whether a product vulnerability contributed has not been established

ConnectWise Trust Center (advisory) 2026-10-21

As of 19:00 UTC on October 16, Huntress has confirmed unauthorized sign-ins in 162 tenants.

The credential type was a client assertion, which means the credential lives in the vendor's own tenant.

These tenants are in the policy, national security, trade, and critical mineral sectors.

Huntress 2026-10-16

Because the application already held broad, previously granted permissions in each tenant, those sign-ins gave the attacker the technical ability to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats.

Revoking user sessions does not end this access.

Todyl 2026-10-15

Previously issued access tokens may remain usable until they expire or are otherwise invalidated.

ConnectWise Trust Center (advisory) 2026-10-21

Disabling the app in a tenant stops new tokens from being issued there, though tokens already issued stay valid for up to 90 minutes.

Todyl 2026-10-15

Older tenants may list them under SkyKick names.

SpecterOps 2026-10-17

Since implementing mitigations, we have not observed successful threat activity in the environments we monitor.

ConnectWise Trust Center (advisory) 2026-10-21

the last confirmed successful sign-in we observed with this credential was at 08:44 UTC on October 15

Huntress has identified a second tenant with post-compromise activity

the application granted itself Global Administrator, then planted a new secret on a small number of other applications in the tenant to keep a foothold

The choice of which applications to backdoor appeared to be random in the two tenants we reviewed.

The access may have been used for Microsoft Graph directory reads, which leave no audit record.

we also found no evidence of mailbox or file manipulation, or user or policy changes

Huntress 2026-10-16

Tenants were accessed in strictly ascending tenant GUID order.

As of this publication, there is no evidence that the application created new secrets, applications, consents, or role assignments in the reviewed tenants.

Sophos X-Ops 2026-10-19

Microsoft assesses that Storm-0940 was responsible for the recently disclosed

Storm-0940 used ARTEX to attempt to sign-in to more than 2,250 tenants at 2,900 sign-in attempts per minute

These changes can remain active as a backdoor even after the original compromised application is mediated.

Microsoft Threat Intelligence 2026-10-21
Improvementrun 2026-10-19T0256Z-intelactionssourcesevidencesourcing_notebody

ConnectWise's update of 2026-10-18 01:00 UTC took SaaS Security and Cloud Management offline in addition to Cloud Backup, which had been suspended since 2026-10-17, so ConnectWise SaaS Security monitoring and alerting is out of service as well, and the update of 2026-10-19 01:15 UTC still gives no restoration time (ConnectWise, 2026-10-19). Disabling an app stops new tokens only: Todyl and SpecterOps each state that tokens already issued stay valid for up to 90 minutes, and ConnectWise says that after it revoked the Cloud Backup certificates previously issued tokens may remain usable until they expire (Todyl, 2026-10-15; SpecterOps, 2026-10-17; ConnectWise, 2026-10-19). Todyl says to find every SkyKick and ConnectWise app in a tenant, inherited ones included, and that all SkyKick apps are published from one vendor tenant, and SpecterOps hunts for apps owned by that tenant, noting that older tenants may list them under SkyKick names (Todyl, 2026-10-15; SpecterOps, 2026-10-17).

Updaterun 2026-10-20T0256Z-inteltitlesummaryactionssourcesevidencesourcing_notebody

Huntress's update of 2026-10-19 13:30 ET identified a second tenant with post-compromise activity, a tenant Huntress did not originally protect, where it got deployed to collect telemetry (Huntress, 2026-10-16). In both tenants the activity was fast and scripted, within two minutes of each other around 03:45 UTC on 2026-10-15: the application granted itself Global Administrator and then planted a new secret on a small number of other applications to keep a foothold (Huntress, 2026-10-16). The choice of applications appeared random: the same flow picked two different sets, one application present in both was backdoored in only one, and in one tenant the applications that received secrets were among the least privileged in the environment while far more powerful ones were untouched (Huntress, 2026-10-16).

Huntress says the unauthorized sign-ins with the credential were tightly bunched across the morning of 2026-10-15 UTC, the last confirmed successful sign-in it observed was at 08:44 UTC, and it saw only failed attempts afterwards in the tenants where it can read sign-in logs (Huntress, 2026-10-16). The access may have been used for Microsoft Graph directory reads, which leave no audit record, and in the two tenants Huntress reviewed it found no evidence of mailbox or file manipulation or of user or policy changes (Huntress, 2026-10-16). The check for planted credentials therefore has to cover every application registration and enterprise application in the tenant, and a clean audit log does not exclude directory reads. ConnectWise's latest readable update (2026-10-19 01:15 UTC) gives no restoration time (ConnectWise, 2026-10-19).

Improvementrun 2026-10-21T0256Z-intelsourcesevidencesourcing_notebody

Sophos X-Ops independently observed the token requests: on 2026-10-15 a single virtual private server authenticated as the ConnectWise Cloud Backup application and requested app-only Microsoft Graph tokens for about 96 minutes, from 07:11 UTC, in strictly ascending tenant-ID order, one to six minutes apart, using Python HTTP-library user agents, and the sweep included tenants with no active backup subscription (Sophos X-Ops, 2026-10-19). Sophos found no hands-on-keyboard activity and no evidence that the application created new secrets, applications, consents or role assignments in the tenants it reviewed, which differs from the role grants and added secrets Huntress reports in other tenants; Sophos says it is unclear how the credential was obtained and what was done with the tokens (Sophos X-Ops, 2026-10-19). The two vendors' sweep timings differ: Huntress puts the first app sign-ins at 06:13 to 08:34 UTC on 2026-10-15 with tenants taken in sorted GUID order a few seconds apart (Huntress, 2026-10-16), where Sophos gives about 96 minutes from 07:11 UTC, one to six minutes apart; the vantage points differ, so both are reported as stated.

Updaterun 2026-10-22T0256Z-intelbodyentitiesevidencesourcessourcing_notesummary

Microsoft Threat Intelligence assesses that Storm-0940, a China-state aligned actor active since 2021, was responsible for the compromise. It says AI agents running the ARTEX framework kept signing in to customer tenants as the ConnectWise applications, without an interactive user sign-in, and in multiple tenants went on to Microsoft Graph reconnaissance, application credential changes and attempts to change privileges (Microsoft, 2026-10-21). It counts attempted sign-ins to more than 2,250 tenants at up to 2,900 attempts a minute and links the activity to an automated cross-tenant password spray between 2026-10-10 and 2026-10-14 against 327 accounts at eight organizations, from the same network range and including an address that ConnectWise's advisory later listed among its indicators; the spray produced no successful authentication (Microsoft, 2026-10-21).

Microsoft warns that the application credential changes can remain active as a backdoor after the vendor application is remediated, and asks tenants to review service-principal sign-ins from at least 2026-10-15, and from 2026-10-01 where records exist, together with the Entra audit trail for credential additions, role assignments, consents and owner changes (Microsoft, 2026-10-21). Expel, which analysed the activity separately, relays the attribution, notes that ConnectWise's fix leaves secrets planted on other applications in place and that Graph directory reads leave no Entra audit record, and says Huntress has not tied its Global Administrator observation to the same operator (Expel, 2026-10-21). ConnectWise itself says that, based on the evidence available to it, including threat intelligence shared by Microsoft, it appears a China state-aligned group was responsible and used an openly available agentic AI framework (ConnectWise, 2026-10-21). It began restoring services in controlled phases on 2026-10-21, expects it to take several days, says the start of restoration does not mean all capabilities are available, and tells partners to keep affected connections disabled until formal instructions apply to their service, while noting that its actions do not remove unauthorized access already established in individual customer tenants (ConnectWise, 2026-10-21; heise online, 2026-10-21). ConnectWise publishes updates twice daily from 2026-10-22 (ConnectWise, 2026-10-21).

incident18 Oct 03:30Zmulti-sourceOpen finding →
Sources: ConnectWise Trust Center (advisory) · Huntress · Todyl · BleepingComputer · SpecterOps · Sophos X-Ops · Microsoft Threat Intelligence · Expel · heise online

2026-10-22 · view entry permalink →

NOTABLENATOB2

ARTEX: Microsoft reports Storm-0940, a China-state aligned actor, running an open-source multi-agent LLM penetration-testing framework against hundreds of organizations, with privileged cloud access in under three hours in some cases, and Expel sees the same infrastructure abuse Okta self-service registration

Microsoft Threat Intelligence reports that as early as September 2026 Storm-0940, a China-state aligned actor active since 2021, used the agentic penetration-testing framework ARTEX to automate attacks on hundreds of organizations across many industries, government and military among them (Microsoft, 2026-10-21). ARTEX is an open-source multi-agent LLM system that can use any AI model and runs a penetration test from reconnaissance to exfiltration with little human involvement (Microsoft, 2026-10-21). Microsoft says ARTEX accelerated the abuse of compromised applications already granted access to Microsoft 365 tenants (Microsoft, 2026-10-21), and Expel adds that it is not a vulnerability and only speeds up familiar techniques such as password spraying and OAuth-application abuse (Expel, 2026-10-21); most targeting failed, yet several cases went from first targeting to privileged cloud access in under three hours (Microsoft, 2026-10-21). Microsoft assesses the same actor was behind the ConnectWise Cloud Backup application-credential abuse (Microsoft, 2026-10-21).

Expel saw Storm-0940 infrastructure scan a customer and, from 2026-10-13, abuse its Okta self-service registration with no ConnectWise application involved: the attacker created five accounts of its own, enrolled Okta Verify on three of them about a minute after activation, made 50 single sign-on logins with more than 100 OAuth tokens issued and ran a password spray that Okta ThreatInsight blocked (Expel, 2026-10-21). Expel says the shared source address is its only link to Storm-0940, the activity alone does not prove ARTEX was used, and it had not seen the technique reported before (Expel, 2026-10-21). Other actors use it: CrowdStrike analysed an unnamed, probably Chinese-speaking and financially motivated actor that ran ARTEX against South Korean financial institutions from late September (CrowdStrike, 2026-10-07), and Recorded Future, which tracks that activity as TAG-217, says use of ARTEX and other AI penetration-testing tools is not limited to it (Recorded Future, 2026-10-16).

Triage: Python and curl user agents match common legitimate automation, so Expel treats them as supporting evidence only, and a Python user agent on an application that normally calls Microsoft Graph with a .NET SDK is the anomaly (Expel, 2026-10-21).

used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries

including multiple instances where the time from initial targeting to privileged access was less than 3 hours

While the majority of the targeting wasn’t successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time.

Microsoft Threat Intelligence 2026-10-21

Used Okta self-service registration to create five accounts of its own, then enrolled Okta Verify on three of them

The shared IP is our only link to Storm-0940, and this activity alone doesn’t prove ARTEX was used.

ARTEX isn’t a vulnerability, so there’s nothing to patch. It speeds up familiar techniques like password spraying and OAuth app abuse.

Expel 2026-10-21

the threat actor is likely a Chinese speaker and financially motivated

CrowdStrike Counter Adversary Operations 2026-10-07

Builds on: ConnectWise SkyKick app credential used in 162+ Microsoft 365 tenants; disabling it does not…

threat22 Oct 03:45Zmulti-sourceOpen finding →
Sources: Microsoft Threat Intelligence · Expel · CrowdStrike Counter Adversary Operations · Recorded Future Insikt Group

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats2

Source distribution

  • bleepingcomputer.com1 (9%)
  • connectwise.com1 (9%)
  • crowdstrike.com1 (9%)
  • expel.com1 (9%)
  • heise.de1 (9%)
  • huntress.com1 (9%)
  • microsoft.com1 (9%)
  • recordedfuture.com1 (9%)
  • other3 (27%)
All cited sources (11)