China‑Linked Storm‑0940 Uses AI Tool ARTEX to Compromise ConnectWise Cloud Backup, Gaining Privileged Access to 2,250 Microsoft 365 Tenants

What happened

Storm‑0940 employed the open‑source AI pentesting framework ARTEX to automate password‑spraying and OAuth abuse against ConnectWise Cloud Backup. After harvesting ConnectWise service‑account credentials, the group logged directly into customer Microsoft 365 environments, achieving privileged cloud access in under three hours for more than 2,250 tenants.

Why it matters for trust and compliance

• The incident shows how a compromised SaaS provider can bypass traditional perimeter defenses, making continuous vendor‑risk monitoring and real‑time credential‑use analytics a core control‑assurance requirement.
• Continuous monitoring of third‑party credential usage provides defensible evidence for audit and due‑diligence.
• Mapping OAuth application permissions to a control‑assurance framework helps demonstrate supply‑chain risk mitigation.

Who is affected

Recommended actions

1. Audit and restrict OAuth permissions for all third‑party integrations.
2. Deploy real‑time detection of credential‑spraying and anomalous login patterns.
3. Add ConnectWise to your third‑party risk register and request evidence of their control‑assurance processes.