Threat feed

Storm-0940 + ARTEX

China state-aligned actor used an agentic AI pentest framework to drive the ConnectWise Cloud Backup app abuse across 2,250+ M365 tenants

Posted · Updated · Spectrum Delta Research Team

Summary

Microsoft (Oct 21) attributes the ConnectWise compromise (posted Oct 17) to Storm-0940. ARTEX agents ran a cross-tenant password spray, then used the stolen ConnectWise app credentials to sign in without any user, reaching 2,250 tenants at about 2,900 sign-in attempts a minute. In some tenants the agents went on to Graph recon, app credential additions and self-assigned privileged roles that persist after the vendor app is cleaned up.

Breakdown

Adversary

Storm-0940

Procedures (8)

  1. Cross-tenant password spray against M365 and Exchange Online

    Logs

    Entra sign-in logs with failure codes (invalid password, locked account), by source IP and many accounts per minute.

Click to expand remaining (7) procedures

  1. Vendor app signs in without a user, from non-vendor IPs with scripting user agents

    • T1550.001Use Alternate Authentication Material: Application Access Token
    • T1078.004Valid Accounts: Cloud Accounts

    Logs

    Entra service-principal sign-in logs for the four app IDs; review successes and failures separately and from Oct 1.

  2. Directory, permission and approval enumeration through Graph

    • T1087.004Account Discovery: Cloud Account
    • T1069.003Permission Groups Discovery: Cloud Groups

    Logs

    Microsoft Graph activity logs (request URI, method, response code) for the app's service principal; an empty result does not prove no access.

  3. Application or service-principal credentials added for persistence

    • T1098.001Account Manipulation: Additional Cloud Credentials

    Logs

    Entra audit log, credential/secret/certificate additions on applications and service principals, and new apps, service principals or owners.

  4. Application self-assigns Global Administrator via 'Add member to role'

    • T1098.003Account Manipulation: Additional Cloud Roles

    Logs

    Entra audit log, role-membership additions where the actor is a service principal and the target is the same app.

  5. Service principal grants itself or another service principal highly privileged app roles

    • T1098.003Account Manipulation: Additional Cloud Roles

    Logs

    Entra audit log, app role assignment and consent grant events initiated by a service principal.

  6. High-volume mailbox access, and Teams Messages folder access through an email client, by a newly privileged OAuth app

    • T1114.002Email Collection: Remote Email Collection
    • T1213Data from Information Repositories

    Logs

    Exchange MailItemsAccessed with app ID and session; mailbox folder access auditing.

  7. SharePoint enumeration shortly after app creation or modification

    • T1213.002Data from Information Repositories: Sharepoint

    Logs

    SharePoint/OneDrive audit events and Graph activity logs, joined with the app create/modify audit events.

Indicators of compromise

Hunt only rotating infrastructure — ips

144.172.64.99 (password spray and app sign-ins), 144.172.64.128, 144.172.64.60

Hunt only rotating infrastructure — vpn ips oct 15 16 only

187.15.88.186, 187.15.89.186, 187.15.90.217

Durable — app ids

506e08f9-6e9a-4da4-942b-a099a03644ae (ConnectWise Cloud Backup), 24205314-2b89-4e07-a2a4-579e898a5640 (ConnectWise MS Teams), 0de14c77-b9b0-4137-9360-34878a929827 (ConnectWise MS Graph), c921256f-04a7-44e8-9b2a-69c33929ba19 (SkyKick Partner Portal)

Durable — user agents on app sign ins

python-urllib/3.12, python-requests/2.31.0, python-requests/2.34.2, curl/7.88.1, azure-toolkit/1.0

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of Storm-0940 + ARTEX? Bring them to the community.

Discuss in the Tradecraft Slack