Microsoft says Storm‑0940 used AI to hit 2,200+ tenants via ConnectWise

Microsoft says a China‑linked crew didn’t just break into a software supply chain — it brought AI to speed things up.

On Wednesday, Microsoft attributed the recent ConnectWise Cloud Backup compromise to Storm‑0940 and said the actor leaned on an AI‑enabled pentesting tool to automate parts of the attack against more than 2,200 tenants. That scale matters for anyone running email and identity on Microsoft 365.

What happened

Microsoft’s investigation linked Storm‑0940, a China‑aligned threat actor, to the supply chain compromise of the ConnectWise Cloud Backup application, according to Dark Reading and The Hacker News. The company said the attackers used an AI‑assisted penetration‑testing framework to accelerate discovery and exploitation.

Reports identify the tool as ARTEX, a Go‑based agentic AI framework designed to automate pentest tasks. The Hacker News notes ARTEX was later made closed‑source after it was abused against South Korean financial institutions — a reminder that dual‑use tooling can quickly become off‑limits once defenders notice how it’s being wielded.

Dark Reading reports the attack touched more than 2,200 customer tenants, underscoring the multiplier effect when a trusted vendor component is compromised. Tenants in Microsoft’s parlance are distinct organizational instances, so impact at that number signals broad reach rather than a single victim environment.

This new attribution lands after ConnectWise previously confirmed unauthorized access tied to its backup product and took the service offline. As we covered earlier, a compromised Cloud Backup credential let unknown actors hop into 173 Microsoft 365 tenants, prompting ConnectWise to pull the app and disable seven application identities. Those immediate steps are detailed in ConnectWise pulls Cloud Backup after 173 M365 tenants hit.

The technical through‑line here is OAuth and app consent: backup tools often hold powerful, tenant‑wide permissions to read and copy data. When that access is abused, attackers can pivot rapidly across services — including email — without tripping the user‑login alarms most teams watch.

Microsoft’s callout of AI in the kill chain adds another angle. Agentic frameworks can enumerate targets, test permissions, and chain actions across APIs at machine speed. That doesn’t make defense impossible, but it compresses timelines for detection and response.

The background

ConnectWise’s Cloud Backup sits in the administrative stack many MSPs and IT teams use to protect Microsoft 365 data. That positioning made it a tempting target: compromise once, inherit broad data access. We’ve seen similar “one update, many victims” dynamics in developer ecosystems too; the credential‑stealing release that briefly hijacked LiteLLM’s distribution is a recent example from the software side, covered in LiteLLM release hijacked: malicious 1.107.0 hit PyPI and Docker.

Supply chain incidents cut across categories on our site; if you follow email security, the thread to pull is vendor trust. In our security coverage, we’ve tracked how attackers piggyback on legitimate infrastructure and permissions to evade filters. A coalition’s recent takedown of cloud‑abusing phish kits showed the same pattern at messaging scale, in Phishing takedown targets the cloud accounts behind the scams.

ARTEX’s role highlights how AI agents aren’t theoretical in offensive operations. The Hacker News describes ARTEX as Go‑based and “agentic,” meaning tasks can be broken into subtasks and executed in sequence without manual driving. For defenders, that shifts the behavior to watch for: short, parallel bursts of enumeration and access attempts rather than a slow, linear probe.

The earlier phase of this incident already carried concrete numbers: 173 Microsoft 365 tenants saw unauthorized access routed through ConnectWise’s identities before the vendor shut Cloud Backup down and disabled seven app identities. Those figures set a floor for what was touched directly, while Microsoft’s 2,200‑plus tenant count shows how wide the net was cast overall.

The China linkage isn’t new for enterprise cloud targeting, but naming matters for visibility. Microsoft’s Storm designations help defenders coordinate intelligence without over‑speculating on ultimate intent. Here, the intent looked like speed and breadth, not one high‑value crown jewel.

What people are saying

Microsoft’s disclosure frames Storm‑0940’s use of an AI‑enabled pentest toolkit as a force multiplier. That lines up with what email security vendors have been bracing for as autonomous tools mature. Proofpoint, for example, has been pitching detections tuned to intent and cross‑channel behavior — a direction we covered in Proofpoint wants email defenses to read intent, not just signals.

ConnectWise, for its part, previously reacted by taking Cloud Backup offline and cutting off seven application identities. That decisive move reduces active blast radius, but it leaves customers with homework: inventory what those app identities could touch, check whether backups included mail data, and verify that restore operations can’t be abused to re‑introduce tampering.

Security teams reading the AI angle are treating it as an operations problem, not magic. Agentic tools still call known APIs, leave sign‑in and app‑only access trails, and have to respect rate limits unless they rotate identities. That’s good news for defenders with log pipelines aimed at Azure AD, Exchange Online, SharePoint, and OneDrive access patterns.

Email program owners — not just SOC teams — have skin in this game. If your billing, authentication, or support emails rely on Microsoft 365, mailbox exposure can leak tokens, invoices, and customer PII. We explored the downstream risks when large email datasets leak at once in Capcom breach exposes 11.7m emails. Phishing risk follows., and the lesson holds for tenant‑level access too.

What happens next

Expect more scrutiny on third‑party apps with tenant‑wide scopes in Microsoft 365. Admin consent workflows, conditional access for service principals, and stricter vendor reviews are the immediate governance levers most orgs can pull without buying anything new.

Microsoft’s attribution to Storm‑0940 and mention of ARTEX will likely feed detection content from EDR, SIEM, and email security vendors. Watch for updated analytics focused on fast, parallel enumeration, unusually broad directory reads, and sudden spikes in app‑only mailbox access.

For ConnectWise customers, the near‑term task list is concrete: confirm Cloud Backup remains disabled in your tenant, review audit logs around the seven app identities ConnectWise pulled, and validate that no unexpected restores or bulk exports touched email or file data during the affected windows.

On the AI front, assume tools like ARTEX will keep evolving outside public repos. That means behavior‑based detections, least‑privilege scoping, and rate‑limit alerts matter more than chasing tool names. If you can spot machine‑paced reconnaissance, you can still win on response time.

Finally, rehearse a vendor‑app kill switch. The teams that fare best in supply chain incidents know exactly how to revoke consent, rotate secrets, and communicate to stakeholders in under an hour. In AI‑accelerated attacks, those minutes count more than ever.