Storm-0940 Leverages ARTEX for ConnectWise OAuth Persistence at 2900 Attempts per Minute

Storm-0940 conducted automated cross-tenant sprays from 144.172.64[.]99 between 10-14 October, generating 151000 failed logons with peaks of 2900 failures per minute. On 15 October the actor pivoted to stolen ConnectWise cloud application identities, using pre-trusted OAuth tokens to reach Microsoft 365 tenants without interactive sign-ins. AI-driven follow-on activity included rapid Graph reconnaissance, credential modifications for persistence, and privilege escalations, achieving privileged access in under three hours for multiple victims.

Technical telemetry shows the same Quad7 botnet infrastructure previously linked by Microsoft in November 2024. ARTEX, originally open-source and later closed after South Korean financial targeting, now operates at machine speed to compress the reconnaissance-to-persistence timeline. This matches patterns in earlier supply-chain incidents such as 3CX and SolarWinds where initial vendor compromise enabled downstream OAuth abuse.

Independent verification of state attribution remains limited to infrastructure overlap and TTP reuse; no public code-level artifacts tie the campaign directly to PRC entities. Defenders face a detection window measured in minutes rather than days.

Expect continued targeting of managed-service providers whose applications hold broad OAuth scopes. Organizations should audit application credentials and monitor for anomalous Graph calls from known vendor tenants.