Microsoft Put a Name on the ConnectWise App Compromise: Storm-0940, Running an AI Attack Framework. Here Is What Changes for You.
Microsoft said on October 21 that Storm-0940, a group it describes as China state-aligned, was behind the ConnectWise app compromise that hit Microsoft 365 tenants this month. The group used ARTEX, a framework first published as open source that strings AI agents together to run an attack from reconnaissance to theft. If any of your tenants ever authorized a ConnectWise app, the advice from October 17 still stands: find it, keep it disabled, and keep your logs. What the attribution adds is a reason to look harder and further back.
What Microsoft added
A name. Storm-0940 has been active since 2021, according to Microsoft, and has no known aliases at other vendors.
The tool. ARTEX is a multi-agent framework written in Go that can drive any AI model. Microsoft says the group used it to try sign-ins against more than 2,250 tenants, at up to 2,900 attempts a minute.
How far it got. Most of the targeting failed. But Microsoft says several attacks ended with the group holding privileged access to an organization's cloud, some in under three hours from first contact.
What it did inside. It signed in through apps that tenants had already approved, so no user had to log in. It then used Microsoft Graph to look around, add credentials to apps, and change identities, groups and privileged roles.
Microsoft itself. Microsoft says its own systems were not compromised and no flaw in its products was involved.
What to do, in order
Find the apps. Search every tenant, including inactive integrations, for these application IDs: 506e08f9-6e9a-4da4-942b-a099a03644ae (ConnectWise Cloud Backup), 24205314-2b89-4e07-a2a4-579e898a5640 (ConnectWise - MS Teams) and 0de14c77-b9b0-4137-9360-34878a929827 (ConnectWise - MS Graph). Microsoft's text mentions four IDs but lists only these three. Keep them disabled until ConnectWise gives restoration steps.
Keep the evidence first. Preserve Entra sign-in and audit logs, Purview audit records and your SIEM data before you remove anything. Microsoft asks for review from at least October 15, and from October 1 where you can.
Look past the IPs. Check service principal sign-ins, both successful and failed, plus any new app credentials, new apps or owners, role assignments and consent grants. Microsoft says plainly not to limit the review to its published addresses.
Watch for scripted clients. Microsoft saw these user agents on the malicious activity: Python-urllib/3.12, python-requests/2.31.0, python-requests/2.34.2, curl/7.88.1 and azure-toolkit/1.0. They are common, so they help only in combination with one of the app IDs.
What we checked and what we hold
Our tenant. None of the three ConnectWise app IDs exists in our Microsoft 365 tenant. We checked on October 22. Our October 17 post covers the rest of the checklist we ran on ourselves, and what it found.
Our feed. The three addresses Microsoft attributes to Storm-0940, 144.172.64.128, 144.172.64.99 and 144.172.64.60, were already in our feed from October 17 and 19. They came from public ConnectWise reporting after the advisory went out, so that is coverage, not a lead. What they lacked was a name: a search for Storm-0940 returned nothing. Today we tagged all three with Storm-0940 and ARTEX at confidence 85, under source manual-batch-storm-0940-artex. We left out the three 187.15.x addresses, which Microsoft calls transient VPN exits.
Earlier ARTEX coverage. On October 12 we wrote about a different ARTEX operator, the one CrowdStrike found going after South Korean financial firms. Microsoft does not say that operator is Storm-0940, and none of the ten addresses we hold from CrowdStrike's report overlaps with Microsoft's list. Same tool, and so far no evidence of the same hands.
Microsoft's write-up, with the hunting queries for Defender XDR and Sentinel: Storm-0940 uses ARTEX agentic AI in a ConnectWise supply chain compromise. Our earlier posts: the ConnectWise checklist on our own tenant and the ARTEX playbook that was a CLAUDE.md file.
If this was useful, or if it wasn't, the rating widget below takes ten seconds and is the only way we know.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=microsoft-put-a-name-on-the-connectwise-app-compromise-storm-0940-running-an-ai-attack-framework
Comments