A specialized AI framework facilitated rapid authentication and reconnaissance across hundreds of global organizations without needing active user sign-ins. Microsoft Threat Intelligence attributes the operation to Storm-0940, a China state-aligned actor that used the agentic AI penetration testing tool ARTEX to accelerate the abuse of compromised application credentials. The AI-driven automation allowed the actor to modify privileges and establish persistent access to targets across various industries.
The attacks targeted Microsoft 365 tenants through a supply chain breach of ConnectWise Cloud Backup, formerly known as SkyKick. Hackers used a stolen vendor credential to gain unauthorized entry and escalate privileges within customer environments. In response, ConnectWise suspended its backup and restoration services and disabled 7 app identities to contain the breach, though analysts warn that overprivileged OAuth applications may have exposed a wider range of downstream customers.
