AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise

What it is

Microsoft Threat Intelligence attributes the October 2026 ConnectWise multi-tenant OAuth application compromise to Storm-0940, a China-state aligned actor active since 2021. The actor used ARTEX, an open-source multi-agent LLM pentest framework (Go backend, Next.js frontend, model-agnostic), to run scanning, password spraying and OAuth app abuse at machine speed. Microsoft states this was not a vulnerability in or compromise of Microsoft systems.

How it works

The sequence below is as the page describes it.

1. From 10 to 14 October 2026, infrastructure at 144.172.64[.]99 sprayed 327 accounts across eight organizations. Telemetry showed 151,000+ failed logons, peaking at 2,900 failures per minute on 11 October. About 98% of responses were lockouts, and no successful authentication was observed.
2. On 15 to 16 October, public ConnectWise indicators matched the 144.172.64.x range. The vendor advisory listed 144.172.64[.]99 exactly.
3. With control of the ConnectWise app identities, the agents authenticated to customer tenants as the apps, with no interactive user sign-in, from the same IP range.
4. In some tenants they went on to Microsoft Graph and directory operations: reconnaissance, application credential changes, and changes to identities, groups and privileged roles. The ATT&CK mapping includes self-assignment of Global Admin from a ConnectWise management application.

flowchart LR
  A[Password spray 10-14 Oct] --> B[ConnectWise app creds stolen]
  B --> C[App-only sign-in to tenant]
  C --> D{Follow-on?}
  D -->|Some tenants| E[Graph recon, credential adds, role changes]
  D -->|Others| F[Auth only, no data access shown]
  E --> G[Persists after app is remediated]

Preconditions / Affected

A tenant is exposed if any of four app IDs is or was installed or authorized, even if the integration is unused:

• 506e08f9-6e9a-4da4-942b-a099a03644ae (ConnectWise Cloud Backup)
• 24205314-2b89-4e07-a2a4-579e898a5640 (ConnectWise - MS Teams)
• 0de14c77-b9b0-4137-9360-34878a929827 (ConnectWise - MS Graph)
• c921256f-04a7-44e8-9b2a-69c33929ba19 (SkyKick Partner Portal)

Microsoft counts 2,250+ tenants reached at 2,900 sign-in attempts per minute, with privileged access in under 3 hours in several cases. Most targeting failed.

What to do

• Search by application ID, not display name, in every tenant.
• Keep the ConnectWise app connections disabled until ConnectWise issues restoration instructions.
• Do not delete the enterprise apps first. Preserve config and evidence (Entra sign-in and audit logs, Purview Audit, SIEM) before irreversible changes.
• Review from at least 15 October 2026. Extend service-principal sign-in review to 1 October where logs exist.
• Review successful and failed service-principal sign-ins separately, and do not limit the review to published IPs. Indicators: 144.172.64.60, 144.172.64.99, 144.172.64.128.
• Audit Entra for credential additions on apps and service principals, new apps, service principals or owners, app-role and consent grants, privileged role assignments, and changes to users, groups, authentication methods or Conditional Access.
• Check M365 audit for unusual mail or file access, forwarding, inbox or transport rules, and delegated mailbox permissions.
• After preserving evidence, have an authorized responder remove confirmed unauthorized credentials, grants, owners and identities, then rotate credentials.

The page supplies hunting queries in four forms. Defender XDR: OAuthAppInfo (is the app present, with what permissions, and its ServicePrincipalId), and EntraIdSpnSignInEvents unioned with GraphAPIAuditEvents from 2026-10-13. Sentinel: SigninLogs and MicrosoftGraphActivityLogs from 2026-10-13. The IP filter in each can be commented out for broader hunting. The Sentinel SigninLogs query is a plain SigninLogs filter on AppId in (ConnectWiseApps).

Caveats

• Credential changes made by the agents can persist as a backdoor after the original app is remediated, so removing the app is not enough.
• An affected app or successful authentication does not by itself show data access or exfiltration.
• Empty Graph log results do not prove no access occurred.
• The page gives no ARTEX version or download source, and it notes only that public reporting tied ARTEX to attacks on Korean financial institutions.