Article 318: Storm-0940 Ran a Pen-Test Framework at Machine Speed and Got Privileged Cloud Access in Under Three Hours

Microsoft published the post-mortem on October 21, and the number that matters is not the victim count. It is the elapsed time. In several Storm-0940 intrusions, the gap between first touching a target and holding privileged access to its cloud infrastructure was less than three hours.

The tool was ARTEX, an open-source agentic penetration-testing framework: a multi-agent LLM system written in Go with a Next.js frontend, capable of running reconnaissance through exfiltration with little human interaction. It is not bespoke malware. It is a public framework, and Microsoft says it has been used by threat actors across multiple regions, including in the personal-data breaches that hit Korean financial institutions.

What actually happened, in order

  • October 10-14: Storm-0940 infrastructure at 144.172.64[.]99 ran an automated cross-tenant password spray against 327 accounts at eight organizations. Microsoft's telemetry captured 151,000+ failed logons, peaking at 2,900 failures per minute on October 11, with more than 111,000 in a single day. 48 accounts took over 1,000 failures each. Lockouts were roughly 98% of the activity. No successful authentication was observed from that campaign.
  • October 15-16: ConnectWise disclosed a compromise of its Cloud Backup service. Public indicators matched the same /24 network range.
  • After that: Having taken control of identities attached to ConnectWise's multi-tenant cloud applications, the agents authenticated into downstream customer tenants using the trust those apps already had. That is the key detail: no interactive user sign-in, no MFA prompt, no phishing link. The door was already open and the agent just walked through it.
  • In some tenants: The agents moved past authentication into Microsoft Graph and directory operations — reconnaissance, application credential changes for persistence, and modifications to identities, groups, and privileged roles.

ConnectWise's advisory went up October 16; Microsoft says Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 tenants downstream.

Why this is different from previous AI-hacking stories

The earlier entries in this genre were one-off demonstrations: a researcher's agent found a bug, an AI-assisted actor breached a hundred sites. This one is a supply chain compromise where the acceleration came from scale and persistence, not cleverness. The agents did what agents do — attempted every path at once, around the clock, through a weekend, without fatigue or shift change.

And Microsoft is explicit that the volume is not free of signal but that the signal arrives too late: "the speed of the activity allows very little time for Defenders to respond to those alerts and remediate the actor's access in a coordinated fashion." You cannot triage your way out of an attack that completes before the ticket is assigned.

Key Takeaway: The defensive lesson here is not "detect AI agents." It is that application trust is now the fastest lateral-movement path in cloud environments, and it has no human in the loop to break. A multi-tenant app with high-privilege Graph scopes is a standing credential; if someone steals it, every tenant that ever consented becomes reachable at machine speed. Microsoft's own remediation guidance is telling: don't delete the enterprise applications first — preserve evidence, inventory by application ID rather than display name, review service-principal sign-ins separately from user sign-ins, and look for self-assigned role grants. The uncomfortable strategic point: the same agentic tooling that makes offense fast makes defense measurable. An org that can prove what its service principals did on October 15 at 03:00 is the only kind of org that survives an attack whose window is three hours. Everyone else is reading the incident summary after the fact — which is exactly what this blog post is.

Sources: Microsoft Security Blog, "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise," 21 October 2026; ConnectWise status advisory, 16 October 2026