Storm-0940: China's AI Agents Hit 2,250 Microsoft Tenants

By Daniel Rao · October 22, 2026

Somebody finally said the quiet part out loud about AI and hacking: the attackers aren't using AI to find clever new exploits. They're using it to do the boring parts of an attack — the knocking on thousands of digital doors, the trying of stolen keys, the patient privilege escalation — at a speed no human team can match. On October 21, Microsoft put a name, a tool and a number on that shift: a China-state-aligned group it tracks as Storm-0940 used an agentic AI framework called ARTEX to hammer its way into more than 2,250 cloud tenants, at one point firing off 2,900 sign-in attempts a minute. In several cases, the group went from first picking a target to holding privileged access in under three hours.

Photo: file photo of server racks at the NERSC data centre — the Storm-0940 campaign targeted cloud tenants, not physical hardware. Public domain (CC0 1.0) via Wikimedia Commons.

The attribution matters because it answers the question hanging over last week's ConnectWise breach. When ConnectWise disclosed on October 16 that attackers had abused its Cloud Backup environment to walk into customers' Microsoft 365 tenants, the industry knew the how — trusted application identities, no password, no multi-factor prompt — but not the who or the full scale. Microsoft's Threat Intelligence team has now supplied both: Storm-0940, it assesses, was responsible for the ConnectWise supply-chain compromise, and the campaign behind it reached across aerospace and defence, semiconductors, energy, government, legal, media, think tanks and non-profits — sixteen sectors in all.

"This activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and allows them to scale their operations exponentially," Microsoft wrote in its October 21 report. That sentence is doing a lot of quiet work. "Integrating into existing workflows" means this isn't some exotic new AI weapon — it's the same old password spraying and OAuth abuse, except the spray gun is now an agent that never sleeps. "Agents are not constrained by factors affecting humans — they can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously," the report adds. Read that twice. Weekends and holidays used to be when defenders caught their breath. That asymmetry is gone.

A six-week timeline, from spray to supply chain

The campaign unfolded in three acts. As early as September 2026, Microsoft says, Storm-0940 began using ARTEX to automate attacks against hundreds of organisations globally. Then, between October 10 and 14, infrastructure at the address 144.172.64.99 ran an automated cross-tenant password-spray campaign: more than 151,000 failed logons hammering 327 accounts across eight organisations, peaking at 2,900 failures a minute on October 11. Nearly 98 per cent of that activity ended in account lockouts. Not a single authentication succeeded — the spray itself was a failure, and Microsoft is unusually candid about saying so.

But the spray was reconnaissance with a purpose. We read Microsoft's full technical write-up alongside ConnectWise's October 16 advisory, and the address 144.172.64.99 appears in both — that overlap is the thread Microsoft used to tie the spray campaign to what came next. On October 15, public reports of the ConnectWise compromise surfaced carrying indicators in the same address range; on October 16, ConnectWise published its advisory, and one of its indicators matched 144.172.64.99 exactly.

Act three was the supply-chain compromise itself. Having seized control of multiple ConnectWise cloud application identities, Storm-0940's agents authenticated into customer environments through applications that already had access — no interactive user sign-in, no password to phish, no MFA prompt to fatigue. At 2,900 sign-in attempts per minute, the campaign reached more than 2,250 tenants. Microsoft's infographic for the report puts one stomach-turning stat in bold: 200-plus sign-ins in under four minutes, using just four application credentials. Once inside, the AI-accelerated follow-on activity ran through Microsoft Graph — reconnaissance, application credential changes, attempts to modify privileges — the standard playbook for turning a foothold into persistent, privileged access. In multiple instances, the whole arc from first targeting to privileged access took less than three hours.

ARTEX: the tool that escaped the lab

ARTEX is the uncomfortable centre of this story. It is — or was — an open-source agentic AI penetration-testing framework: a multi-agent large-language-model system written in Go, with a Next.js front end, that can drive any AI model through a full penetration test, from reconnaissance to data exfiltration, with little human interaction. Its interface defaults to English but switches to Korean, Mandarin, Spanish or Japanese. It was built for legitimate security testing. It did not stay there.

Microsoft notes that public reporting in October tied ARTEX to personal-data breaches at South Korean financial institutions, and says threat actors across multiple geographic regions now use it. Separately reported — not by Microsoft, so treat the sourcing with care — the framework was released in July 2026 and pulled closed-source in October after the misuse reports, its developer yanking it from GitHub. The Korean episode is worth remembering because it shows the pattern: a dual-use AI tool, built openly, adopted quietly by operators who speak Chinese, and scaled from bank heists to state-aligned supply-chain attacks within weeks. Microsoft is careful to distinguish the two operations — it does not link the Korean-bank operator to Storm-0940 — but the tool is the same, and that is precisely the point. The tooling has commoditised faster than the defences.

No exploit required: how the attack bypassed MFA entirely

Here is the detail that should worry every IT administrator reading this: there was no software vulnerability involved. None. Microsoft states it plainly: "The activity conducted by the threat actor through the usage of ARTEX framework did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services." The attackers didn't break Microsoft's locks. They walked in using ConnectWise's keys — application identities that customers had already trusted — and then used AI agents to abuse that trust at machine speed.

This is the same shape as the year's other supply-chain nightmares, and it connects directly to our reporting on the ConnectWise breach itself, where attackers signed into 173 Microsoft 365 tenants with no password and no MFA prompt. (Note the scopes differ: the 173 figure was the earlier Huntress count of observed sign-ins; Microsoft's 2,250-plus is the campaign's reach.) It also rhymes with the PHP2Shell story from this week — AI models discovering critical flaws in the web's foundations — except here the AI isn't finding the bugs. It's working the burglary.

And there is a sting in the tail that ConnectWise's own chief executive put on the record. Manny Rivelo accepted Microsoft's attribution — "it appears that a China state-aligned group was responsible for the attack on ConnectWise Cloud Backup," he said, based on Microsoft's analysis — and then warned that ConnectWise's containment "does not remove unauthorised access that may have already been established within individual customer tenants, which require separate review." Translation: kicking the attacker out of ConnectWise doesn't kick them out of you. Application credential changes, Microsoft notes, can survive as a backdoor even after the original compromised application is remediated. Rivelo's statement had an unusual quality for breach disclosures: acceptance. Vendors usually lawyer every adjective; here the CEO effectively said, yes, it was them — and, by the way, check your own house. ConnectWise says it has contained the affected application connections and is restoring services in controlled phases.

What Microsoft wants defenders to do

The report is as much a field manual as an attribution. Microsoft advises keeping the affected ConnectWise application connections disabled until ConnectWise issues formal restoration instructions, reviewing service-principal sign-in activity from October 15 — stretching back to October 1 where logs allow — and hunting specifically for application credential modifications, the persistence mechanism Storm-0940 favours. The historical profile helps explain why: this group has been active since at least 2021, with no known industry aliases, doing password spraying and internet-facing application exploitation for initial access, then persisting by adding credentials to existing OAuth applications and exfiltrating mail and data through Microsoft Graph. ARTEX didn't change what Storm-0940 does. It changed how fast it does it — and, Microsoft argues, that speed is the story: "a pace that leaves defenders with little time to detect and respond."

One more honest caveat, because Microsoft includes it and so should we: "the majority of the targeting wasn't successful." Most of those hundreds of organisations fended the campaign off. But Microsoft's next clause is the one that will travel: "Storm-0940 achieved privileged cloud persistence at many organisations in a brief time." Most attacks failing is cold comfort when the ones that succeed take under three hours and leave backdoors that survive cleanup.

173 vs 2,250: what the ConnectWise tenant numbers actually measure

• 162 tenants with confirmed unauthorized sign-ins — Huntress, Oct 16.
• Almost 1,000 Entra tenants with sign-in activity from the attacker IP, 300+ successful — Huntress, Oct 17 update.
• More than 2,250 tenants TARGETED with sign-in attempts — Microsoft, Oct 21.
• 2 tenants with post-compromise changes (roles, planted secrets) — Huntress, Oct 19 update.
• 9 tenants analysed with no directory changes found — Todyl, Oct 16–19.

These numbers measure different things; a successful sign-in is not data theft.

Storm-0940 and ARTEX: FAQ

What is Storm-0940?

A China-state-aligned hacking group tracked by Microsoft, active since at least 2021, with no known aliases used by other threat-intel firms. It steals data across industries — this campaign alone touched sixteen sectors — and its trademark is living off trusted cloud machinery rather than exotic exploits.

What is ARTEX?

An agentic AI penetration-testing framework — a multi-agent system, written in Go, that drives AI models through reconnaissance, exploitation and exfiltration with minimal human input. Built for legitimate testing, adopted by criminals and state-aligned operators, and reportedly pulled closed-source in October 2026 after misuse.

Was Microsoft itself hacked?

No. Microsoft states explicitly that the campaign "did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services." The abuse ran through compromised third-party application identities, not Microsoft flaws.

What should IT teams do right now?

Keep affected ConnectWise app connections disabled until formal restoration guidance lands; review service-principal sign-ins back to October 1; and hunt for added application credentials in your tenants — because, as ConnectWise's CEO warned, cleaning up ConnectWise doesn't clean up you.

Is it safe to reconnect ConnectWise Cloud Backup now?

No: Huntress and Microsoft advise customers not to reconnect the affected applications until ConnectWise issues formal restoration instructions; ConnectWise completed a full credential reset on Oct 19, but Cloud Backup, SaaS Security and Cloud Management all remain suspended, and restoration is expected to take several days once it begins (via The Hacker News, Oct 19).

Were ConnectWise backup archives accessed?

ConnectWise says it has no evidence its encrypted backup archives were accessed (via safeguard.sh / insurancebusinessmag relays, Oct 19–22).

Our read: the front door is now automated

There is a temptation to file this under "China hacks things" and move on. That would miss what actually changed. For thirty years, the defender's advantage in supply-chain attacks was friction: stealing a vendor's keys was hard, using them at scale was slow, and humans needed sleep. ARTEX deleted the last two. The ConnectWise compromise required no zero-day, no brilliant exploit — just a trusted vendor identity and an agent willing to knock 2,900 times a minute until something gave. Defenders spent a decade building walls against exploits; the attackers simply automated the front door. Until detection moves at the same machine speed — and Microsoft's own "little time to detect and respond" concedes it mostly doesn't — every trusted third-party application in your tenant is a potential 2,900-knocks-a-minute problem. That is the botched assumption this campaign exposes: that trust, once granted to a vendor, stays put. It doesn't. It just got faster.

Related: ConnectWise restarts Cloud Backup after attackers signed into 173 Microsoft 365 tenants · AI found 'PHP2Shell' — the critical flaw hiding in the language behind 70% of websites · Palo Alto shed 18% as a zero-day met AI's debt panic

Update, Oct. 22

Huntress's Oct. 19 update adds hard detail on the two compromised tenants behind Microsoft's "privileged cloud persistence" line: in each, the ConnectWise application granted itself Global Administrator and planted new secrets in a small number of other in-tenant applications — credentials set to run until 2028 — for persistence, with the choice of backdoor applications appearing random and no signs the access was weaponized for mailbox or file manipulation (via The Hacker News). Separately, Zscaler researchers documented ARTEX abuse in an Oct. 21 report of their own — while noting they could not establish their investigation covered the same actor Microsoft attributes to Storm-0940 (via cybersecuritynews.com). ConnectWise completed a full reset of accounts and credentials in the affected environment on Oct. 19, but Cloud Backup, SaaS Security and Cloud Management all remain suspended, and Huntress advises customers not to reconnect the affected applications until ConnectWise issues formal restoration instructions.

Sources: Microsoft Threat Intelligence (October 21, 2026 report); Reuters (AJ Vicens); Straits Times (Reuters relay, incl. ConnectWise CEO Manny Rivelo's statement); IntelFusions; CryptoBriefing. The ConnectWise October 16 advisory and Huntress's earlier 173-tenant count are via our own October 22 reporting. Analysis is the author's own.

Daniel Rao covers AI, autonomous agents and the business of technology for TechPulse USA.