AI Framework Powers Supply Chain Assault on 2,250+ Cloud Tenants

Storm-0940, a China-linked threat actor, exploited a compromised ConnectWise Cloud Backup service to attempt accessing Microsoft 365 environments across more than 2,250 organizations. The group deployed ARTEX, an agentic AI penetration-testing framework, to automate reconnaissance, password spraying, and OAuth application abuse. In multiple cases, attackers achieved privileged cloud access within three hours of initial targeting while generating as many as 2,900 sign-in attempts per minute.

The campaign began in September and touched hundreds of organizations across manufacturing, aerospace, chemicals, energy, defense, and financial services. ConnectWise disclosed the unauthorized access on October 16, revealing that application identities associated with its Cloud Backup product had been compromised, though details on the initial compromise method remain unclear. The company subsequently suspended Cloud Backup along with its SaaS Security and Cloud Management services.

ConnectWise reported on October 22 that restoration efforts were underway and backup archives remained encrypted and uncompromised. Security experts recommend organizations verify their Microsoft 365 environments before reconnecting, investigate unauthorized credential changes, preserve forensic evidence, and confirm remediation efforts independently from both vendor and internal perspectives.