Storm-0940 Deploys Artex to Hit 2900 ConnectWise Logons Per Minute Across 300 Tenants

Storm-0940, active since 2021, shifted from manual password spraying to Artex-driven automation in early September. The group targeted ConnectWise cloud services, abused stolen application credentials, then used Microsoft Graph for reconnaissance, role modifications, and credential changes on service principals to maintain access after remediation. ConnectWise suspended Cloud Backup and SaaS Security in response. Microsoft telemetry recorded 151,000 failed events plus successful sign-ins to eight organizations. Zscaler’s later analysis exposed Artex configuration files, Claude Code prompt histories, and synchronization scripts that allowed the actor to scale directory operations at machine speed. CrowdStrike and Recorded Future had previously tied similar Artex activity to South Korean financial targets. The pattern shows nation-state actors treating public AI pentest tools as force multipliers rather than novel malware. Procurement records and job postings from Chinese research institutes indicate sustained investment in automated reconnaissance pipelines that match the observed tempo. Official attribution to Storm-0940 rests on infrastructure overlap and TTP consistency, yet independent verification of the AI agent code remains limited to captured prompts. Defenders must now monitor service principal sign-ins and Graph activity at the same cadence as user logons. Expect Artex variants or equivalent frameworks to appear in additional supply-chain vectors within six months as more groups replicate the observed workflow.