ConnectWise OAuth Abuse: Storm-0940’s ARTEX AI Agents Hit 2,900 Sign-Ins Per Minute

Microsoft Threat Intelligence attributed the recent supply chain compromise of the ConnectWise Cloud Backup application to the China state-aligned actor Storm-0940. The group leveraged ARTEX, an agentic AI penetration testing framework, to accelerate attacks against downstream victims across multiple sectors.

What happened

Storm-0940 compromised application identities within the ConnectWise Cloud Backup service, previously known as SkyKick. According to Microsoft, the attackers used these stolen credentials to authenticate to customer Microsoft 365 environments without requiring interactive user sign-ins. The group utilised ARTEX to automate reconnaissance, password spraying, and OAuth application abuse at machine speed.

Microsoft reported that the threat actor attempted to sign in to more than 2,250 tenants, with activity peaking at 2,900 attempts per minute. This pace significantly reduced the window available for defenders to detect and respond. In several instances, the group achieved privileged access to cloud infrastructure in less than three hours.

Why it matters

The incident highlights the risk posed by third-party applications with broad access to customer data. ConnectWise Cloud Backup relies on app identities that hold extensive permissions, creating a potential route into connected systems if compromised. Attackers modified application credentials and added new authentication keys to maintain persistent access.

Microsoft noted that ARTEX allows agents to operate without human constraints, speeding up the exploitation of granted permissions. The group targeted organisations in defence, government, energy, and semiconductor manufacturing. Huntress had confirmed breaches at 162 tenants by 16 October, while Microsoft’s broader targeting count includes many failed attempts.

Next steps

• Review all third-party application permissions in Microsoft 365 tenants for unnecessary broad access.
• Monitor for unusual changes to OAuth application credentials or administrator roles.
• Verify the integrity of backup service connections and rotate associated secrets immediately.
• Analyse sign-in logs for high-volume authentication attempts from unfamiliar IP ranges.

Detection notes

Security teams should monitor for high-frequency sign-in attempts from application identities, particularly those associated with third-party vendors. Look for rapid changes to OAuth application secrets or permission scopes, which may indicate credential theft. Investigate any new service principals added to privileged groups. Check for automated reconnaissance patterns, such as sequential scanning of user accounts. Contain suspected compromise by disabling affected application identities and revoking associated tokens.

Background: OAuth

OAuth provides delegated, short-lived access for users and services, allowing precise permission control. API keys offer static, long-term identity for server-to-server communication. Choose OAuth for user data and fine-grained control. Choose API keys for simple, automated backend integrations where user context is irrelevant.

Read the full guide: OAuth vs API Key: When to Use Tokens and When to Use Secrets

What to do and how to stay safe: ConnectWise

• Audit all delegated permissions granted to third-party backup and management tools.
• Enable advanced logging for application sign-ins and monitor for anomalous volumes.
• Implement conditional access policies that restrict application authentication to known networks.
• Once the vendor provides an update, apply it immediately and rotate all associated credentials.

Step-by-step guide: Prevent Supply Chain Attacks: Practical Controls for Third-Party Risk

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What tool did Storm-0940 use in the ConnectWise attack?

The group used ARTEX, a Go-based agentic AI penetration testing framework, to automate scanning and credential abuse.

How many tenants were targeted in this campaign?

Microsoft reported that the attackers attempted to sign in to more than 2,250 Microsoft 365 tenants.

Did the attackers require user passwords to gain access?

No, they abused stolen application credentials and permissions already granted within customer tenants, avoiding interactive sign-ins.