A Microsoft security analysis attributes the Storm-0940 operation, a China-linked threat actor, to an AI-enabled penetration-testing framework used to accelerate a supply chain attack involving ConnectWise Cloud Backup. The group leveraged compromised application credentials tied to the ConnectWise service to target Microsoft 365 environments across more than 2,250 downstream tenant organisations.
Microsoft said that in multiple cases the attackers gained privileged access to a victim’s cloud infrastructure within three hours of initial targeting, illustrating the speed and scale at which ARTEX-enabled activity can unfold.
Microsoft’s findings show ARTEX was employed to speed up reconnaissance, credential attempts, and OAuth application abuse, enabling very high-volume sign-in activity—up to 2,900 sign-ins per minute across more than 2,250 tenants. While many initial targets were unsuccessful, the campaign achieved privileged cloud persistence in numerous environments, with the activity routed through Microsoft Graph.
ConnectWise, which provides MSP-focused backup and recovery services for Microsoft 365 data, suspended its Cloud Backup service and other SaaS products as it continued restoration and containment. The firm advised customers to review their Microsoft 365 environments using its technical investigation guide, while Microsoft issued mitigation guidance urging reviews of possibly affected tenants and to preserve logs for forensic analysis before changes are made. Industry observers emphasise the need for careful containment, verification of backups, and the preservation of evidence during recovery and remediation.