Microsoft links AI-assisted Storm-0940 attacks to ConnectWise cloud app compromise
🛡️ Microsoft Threat Intelligence reports that Storm-0940 used the ARTEX agentic AI framework to accelerate attacks, including abuse of compromised ConnectWise cloud application identities to access downstream Microsoft 365 tenants.
In some incidents, the attacker reached privileged cloud access less than three hours after initial targeting.
- Microsoft observed application sign-ins and subsequent Microsoft Graph activity, including reconnaissance and attempted changes to credentials and privileges.
- An affected application or successful authentication does not, by itself, prove customer data was accessed or exfiltrated. Microsoft attributes the activity to compromised third-party application access, not a vulnerability in Microsoft products.
- Microsoft recommends keeping affected ConnectWise connections disabled until the vendor issues restoration guidance, preserving evidence and reviewing Entra service-principal sign-ins, app permissions and audit trails.
Partner briefing
- What it is
AI-accelerated nation-state activity involving Storm-0940, ARTEX and compromised ConnectWise cloud applications.
- What’s changing
Microsoft documented rapid OAuth application abuse against downstream Microsoft 365 customer tenants and published indicators, detections and investigation guidance.
- Why it matters
Managed security and Microsoft 365 service providers should assess potentially affected app connections and tenant permissions; authentication does not automatically establish data exfiltration.
- Who it affects
CSP partners, Microsoft 365 administrators, MSSPs and identity/security teams.