Storm-0940 Uses ARTEX AI to Compromise ConnectWise Supply Chain and Target Microsoft 365 Environments

What happened

In September 2026, the threat actor Storm‑0940 leveraged the ARTEX agentic AI framework to automate penetration testing techniques against a broad portfolio of targets. The campaign focused on the ConnectWise supply‑chain, a multi‑tenant application that had already been compromised. ARTEX enabled the actor to rapidly enumerate and abuse application credentials, allowing authentication into Microsoft 365 environments without interactive user sign‑ins.

Once inside, the adversary used Microsoft Graph to conduct reconnaissance, modify application credentials, and attempt privilege escalation. The entire process—from initial targeting to privileged access—was completed in less than three hours in several instances, underscoring the speed advantage conferred by AI‑driven automation.

Who is affected

Any organization that has integrated the compromised ConnectWise application into its Microsoft 365 tenant is at risk. This includes enterprises across finance, healthcare, manufacturing, and public sector that rely on ConnectWise for remote management and service delivery.

Defenders should also consider any tenant that has granted broad application permissions to third‑party services, as the attacker could exploit those permissions to pivot within the tenant.

Impact

While Microsoft determined that the activity did not stem from a vulnerability in its own products, the compromised credentials allowed the actor to perform unauthorized actions within affected tenants. Potential impacts include data exfiltration, lateral movement, and persistence through compromised service principals.

The rapid credential abuse also increases the likelihood of undetected persistence, as the attacker can establish footholds before defenders notice anomalous activity.

Exposure

ARTEX’s AI capabilities enabled the actor to test multiple attack vectors simultaneously, reducing the time to compromise. The use of Microsoft Graph for post‑exploitation activities means that normal API usage patterns can be masked by legitimate traffic, making detection more challenging.

Because the actor did not rely on a known vulnerability, traditional patching does not mitigate this threat. Instead, exposure is tied to the breadth of permissions granted to third‑party applications and the visibility of their activity.

What to do

• Enable Microsoft Defender XDR detections for suspicious Microsoft Graph activity and known threat infrastructure.
• Review service principal sign‑ins for unexpected or anomalous activity, focusing on high‑privilege applications.
• Enforce multi‑factor authentication for all service principals and privileged accounts.
• Implement least‑privilege application permissions; remove any that are not essential.
• Rotate application credentials regularly and monitor for credential reuse across tenants.
• Deploy hunting queries that flag rapid credential changes or privilege escalation attempts via Microsoft Graph.
• Audit ConnectWise integration settings and verify that only trusted instances are active.

What to watch

Future iterations of ARTEX may incorporate more sophisticated evasion techniques, such as mimicking legitimate API call patterns or leveraging zero‑day vulnerabilities in third‑party applications. Defenders should remain vigilant for sudden spikes in API usage, especially from newly created or recently modified service principals.

Additionally, monitor for signs of automated credential abuse, such as repeated failed sign‑in attempts followed by successful authentication within a short time window. Early detection of such patterns can prevent the attacker from establishing persistence or escalating privileges.