Key points
- Storm-0940 utilized the ARTEX agentic AI toolset in this campaign.
- The group targeted the ConnectWise supply chain to reach customers.
- Attackers abused application credentials within Microsoft 365 environments.
Microsoft Security researchers identified a large-scale nation-state campaign by Storm-0940. This group used ARTEX, an agentic AI system, to accelerate its operations. The attackers compromised the ConnectWise supply chain. This breach allowed them to abuse application credentials. The abuse occurred across Microsoft 365 environments. The report highlights how AI tools can speed up supply chain attacks. It shows risks for organizations using managed service providers. Microsoft published these findings on its security blog. The campaign demonstrates sophisticated technical capabilities.
By the numbers
- 1: The number of major supply chain vendor targeted, ConnectWise.
- 1: The number of AI toolsets used, the ARTEX agentic AI system.
- 1: The number of primary environment abused for credentials, Microsoft 365.
What the figures mean
The use of ARTEX indicates a shift toward automated attack methods. Storm-0940 leveraged this AI to speed up the compromise. By targeting ConnectWise, the group reached many downstream customers. This supply chain approach multiplies the impact of a single breach. Abusing application credentials bypasses standard login protections. It allows persistent access without user passwords. Microsoft’s findings show the operational reality of AI-driven threats. Organizations must consider their vendor risk exposure.
Operational impact
Managed service providers must assess their third-party integrations. Review access controls for all vendor connections. Ensure application credentials are rotated regularly. Monitor for anomalous API activity in your environment. Coordinate with security teams to update incident response plans. Verify that logging captures all authentication events. Communicate clearly with clients about potential risks. Establish clear channels for reporting suspicious vendor behavior. Regularly audit permissions granted to external partners.
Background: Incident response plans
Incident response plans fail when teams assume they cover every attack vector or treat them as static documents. You must focus on decision trees, not scripts. Plan for communication breakdowns, not just technical fixes. Regular table-top exercises reveal gaps that documentation hides.
Read the full guide: Fix Incident Response Plans That Fail Under Pressure
What to do and how to stay safe: Storm-0940
- Review all application credentials in Microsoft 365 and rotate them.
- Audit permissions for third-party integrations and remove excess access.
- Monitor logs for unusual API calls or credential usage patterns.
- Verify the security posture of your managed service providers.
Step-by-step guide: Shadow AI Explained: 8 Questions Answered for Secure Operations
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which group is behind this campaign?
The Storm-0940 nation-state group is responsible for this activity.
What tool did they use?
They used the ARTEX agentic AI system to accelerate their attacks.
Which vendor was compromised?
The ConnectWise supply chain was compromised by the attackers.
