What happens when cybercriminals no longer need to trick an employee into opening a malicious file because they can exploit software your business already trusts?
On October 21, 2026, Microsoft Threat Intelligence reported that China-state-aligned Storm-0940 used an agentic AI framework called ARTEX to accelerate attacks against hundreds of organizations. Microsoft also assessed that the group was responsible for a recently disclosed ConnectWise supply-chain compromise. For business leaders, the issue is how quickly trusted application access can become a pathway into customer environments.
Key Takeaway: AI can accelerate familiar attack techniques from reconnaissance to privileged cloud access. Organizations need strong identity and cloud security alongside endpoint controls that restrict damaging actions without depending entirely on threat identification.
In Microsoft’s October 21 investigation, researchers described Storm-0940 using ARTEX, an open-source agentic AI penetration-testing framework, to automate reconnaissance, password spraying, and OAuth application abuse. During the ConnectWise incident, the actor reached more than 2,250 customer tenants at a rate of 2,900 sign-in attempts per minute. In multiple incidents, attackers progressed from initial targeting to privileged cloud access in less than three hours.
A separate October 10–14 password-spraying campaign generated more than 151,000 failed logins against 327 accounts across eight organizations. Microsoft observed no successful authentication in that particular campaign. Reaching a tenant or successfully authenticating also does not, by itself, prove that customer data was accessed or stolen.
Storm-0940 is not new. Microsoft has tracked the actor since at least 2021. Its October 2024 investigation documented credentials obtained through CovertNetwork-1658, a network of compromised small-office and home routers. Historically, Microsoft observed an average of 8,000 compromised devices in that network. In about 80% of cases, it made only one sign-in attempt per account per day, complicating conventional detection.
Microsoft observed Storm-0940 using some stolen credentials the same day they were obtained. The underlying techniques were already effective; AI now makes it easier to run them rapidly and at scale. Microsoft says Storm-0940 has no known industry aliases, although the covert router network has also been called Quad7 or xlogin.
It exploited permissions that customers had already granted to a third-party application. Microsoft assessed that attackers gained control of credentials for multiple ConnectWise cloud applications and used those identities to authenticate into downstream Microsoft 365 environments without an interactive employee sign-in.
Microsoft observed follow-on Microsoft Graph and directory operations, including reconnaissance, credential modifications, and attempts to change privileges. For MSPs and their customers, one compromised integration can expose multiple environments and create investigation, operational, and recovery costs. However, Microsoft cautions that the presence of an affected application is not proof of data exfiltration.
Agentic AI can carry out sequences of security-testing tasks with limited human direction. In an attacker’s hands, that can mean scanning, testing access, and following up on successful attempts around the clock. The most significant change is not necessarily a new exploit but a much shorter window for defenders to intervene.
When privileged access can be established in under three hours, organizations need automated safeguards and response procedures that operate before a human analyst can investigate every alert.
Some aspects could be detected, and Microsoft published Defender XDR detections and hunting guidance for suspicious Microsoft Graph activity, service-principal sign-ins, and application privilege changes. But endpoint detection alone does not govern cloud OAuth permissions. An application identity can misuse cloud access without running malware on an employee’s Windows computer.
Detect and Respond remains essential. It should be paired with least-privilege cloud permissions, identity controls, application monitoring, and endpoint prevention rather than treated as the only defensive layer.
Certain damaging endpoint actions can be restricted without knowing the attack’s name, signature, or origin. When an attacker reaches a Windows endpoint, they may still need to launch processes, misuse trusted applications, access memory, manipulate files, establish persistence, or encrypt data.
Changing the attack does not necessarily change the endpoint actions the attacker needs to succeed. Isolation and Containment aim to constrain those actions and reduce the usable Windows attack surface. AppGuard is a proven endpoint protection solution with more than a decade of production history focused on prevention through Isolation and Containment. It restricts out-of-bounds endpoint behavior without requiring the specific attack to be identified first.
That does not mean AppGuard or another Windows endpoint control would have prevented the ConnectWise cloud application compromise. Cloud identity abuse requires cloud and identity controls. Endpoint containment is an additional layer when attackers attempt harmful actions on protected devices.
Storm-0940 illustrates how AI can make established techniques faster and more scalable. Organizations should not abandon detection. They should combine it with controls that reduce permissions, restrict attacker behavior, and limit the damage possible after access is gained.
What if you did not have to detect every attack in order to stop its damaging actions? Unknown does not automatically mean unstoppable.
For another example, read 54 EDR Killers: Why Attackers Target Security Before Ransomware.
Primary sources: Microsoft Threat Intelligence, October 21, 2026; Microsoft Threat Intelligence, October 31, 2024.