Overview
On October 21, Microsoft disclosed that a China state-aligned actor it tracks as Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application. The attackers used ARTEX, a Go-based agentic AI penetration testing framework, to automate password spraying and follow-on activity at scale. This adds attribution to the incident we covered earlier in our ConnectWise Cloud Backup coverage.
Who Is Behind It
- Storm-0940 has been linked to the Quad7 botnet (also CovertNetwork-1658), used for password spraying. Microsoft first detailed it in November 2024 and assesses it has been active since at least 2021.
- TAG-217, as tracked by Recorded Future, is the cluster behind attacks on South Korean financial institutions. The Chinese-speaking actor has been active since August 17, 2026.
- ARTEX was made closed-source after it was abused against South Korean financial institutions.
Timeline
| Date (2026) | Event |
|---|---|
| Aug 17 | TAG-217 activity first observed, including remote-access infrastructure testing and scanning |
| September | Campaigns against hundreds of organizations begin |
| Oct 10–14 | Cross-tenant password spray from 144.172.64[.]99 targets 327 accounts across eight organizations; over 151,000 failed logons, peaking at 2,900 per minute on Oct 11 |
| Oct 15 | Agents gain control of identities for multiple ConnectWise cloud apps and use them to authenticate to customer environments |
| Oct 21 | Microsoft discloses the activity |
No successful authentications were detected in the Oct 10–14 spray window itself.
How the Attack Worked
Attackers used ARTEX to reach more than 2,250 tenants at up to 2,900 sign-in attempts per minute. Stolen ConnectWise app credentials let the agents act without interactive user sign-in. In some cases activity progressed to Microsoft Graph and directory operations: reconnaissance, app credential changes for persistence, and changes to identities, groups and privileged roles. In some cases, under three hours passed from initial targeting to privileged access.
Persistence came from adding credentials to existing OAuth apps, which can remain as a backdoor even after the original app is remediated.
AI tooling observed
Zscaler found a custom ARTEX deployment containing AI assistant configurations, sync scripts, network routing tools and a Claude Code prompt history. It was configured to use DeepSeek through an OpenAI-compatible gateway, with other configurations naming DeepSeek, GLM and Grok. Prompts had models divide tasks and review each other's work. Prompt histories requested bulk personal and transaction data, payment gateway API keys and admin privileges, and Zscaler assesses the attacks as financially motivated and opportunistic worldwide.
Who Was Targeted
Affected parties include ConnectWise customers and downstream organizations, including Microsoft 365 and Exchange Online tenants. Targeted sectors include aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and nonprofits. ConnectWise temporarily shut down services and is restoring them in phases over several days.
Indicators of Compromise
| Type | Value |
|---|---|
| IP address | 144.172.64[.]99 |
Recommended Actions
- Alert on high-rate sign-in failures and cross-tenant password spray. The response window is short.
- Audit OAuth applications and service principals for credentials added recently, especially to existing apps.
- Review privileged role, group and identity changes in Entra ID for the period since October 10.
- Block or investigate the listed IP address in sign-in logs.
- Treat MSP and vendor integrations as privileged identities: scope their permissions and monitor their sign-ins.