Storm-0940's 2,900 sign-ins a minute make app-only identity the response boundary

Microsoft Threat Intelligence reported on 21 October 2026 that the China-aligned actor Storm-0940 used the ARTEX agentic penetration-testing framework in campaigns against hundreds of organisations. The report links this activity to the recent ConnectWise cloud-backup supply-chain compromise. During a related Microsoft 365 password-spray operation, Microsoft observed more than 151,000 failed logons and a peak of 2,900 failures per minute. The operational problem is not just faster reconnaissance. A compromised multi-tenant application can authenticate without an interactive user.

Microsoft says some ARTEX-driven attacks reached privileged cloud access in under three hours. In the ConnectWise case, attackers abused application identities that already had customer consent, then used Microsoft Graph for reconnaissance and attempted changes to credentials and roles. The presence of an affected application alone is not evidence of data theft; successful sign-in, subsequent API activity and resource access must be distinguished.

Treat service principals as first-class incident subjects

Microsoft's investigation identifies four ConnectWise and SkyKick application identities that responders should inventory by application ID, not display name. The tenant-specific service principal supplies the investigation pivot. Review current and historical consent, granted application roles, owners and credential changes, including tenants where the integration was previously installed.

Begin with Entra service-principal sign-ins and correlate timestamps, source infrastructure and authentication outcomes with Microsoft Graph operations. Microsoft recommends reviewing activity since at least 15 October and extending sign-in review to 1 October when records exist. A known indicator is useful for prioritisation, but an IP-only query can miss other attacker infrastructure.

When a supplier's application identity is compromised, the incident boundary is every permission that identity can exercise in each customer tenant.

Credential rotation alone does not remove downstream persistence

Microsoft observed follow-on changes that could establish access through newly added application credentials, owners, app-role assignments and privileged roles. Those alterations may remain after the original vendor connection is disabled. Preserve audit records, consent configuration and Graph telemetry before removing confirmed unauthorised grants. Avoid deleting an enterprise application as the first investigative action.

The vendor's containment instructions take precedence for affected connections. Where malicious changes are confirmed, authorised responders should remove them and rotate credentials. Then verify the backup or restore workflow still functions safely; security containment that silently breaks recovery creates another operational exposure.

Machine-speed activity requires prebuilt hunting pivots

Microsoft supplies Defender XDR and Sentinel hunting examples that connect OAuthAppInfo, service-principal authentication and Graph activity. They are starting points, not turnkey proof of compromise: table availability, retention and tenant logging configuration differ. Investigators should identify gaps before declaring a clean environment.

For future supplier integrations, restrict application permissions, monitor app-only sign-in anomalies and alert on credential or role additions to high-privilege service principals. Exercise the response using a simulated vendor credential exposure, measuring how quickly the team can identify affected tenants, preserve evidence and revoke access. ARTEX accelerated the incident, but longstanding OAuth trust and excessive privilege determined its potential impact.

Produced through Devence Lab's automated research and publishing workflow, without prepublication human review. Devence Lab retains editorial responsibility. Sources are linked; report factual errors to contact@devencelab.com.

Written by the Devence Lab research team.