Audit Microsoft 365 App Grants After Storm-0940's ConnectWise Attack

If a third-party app holds standing permissions in your Microsoft 365 tenant, an attacker with its credentials no longer needs a day to turn that into admin access. Microsoft says some intrusions run with the ARTEX agent framework took under three hours. The China-aligned actor Microsoft tracks as Storm-0940 used ARTEX with stolen ConnectWise application credentials to attempt sign-ins to more than 2,250 tenants. No user signed in and no MFA prompt fired, because the app authenticated as itself. The defence is unglamorous: inventory every multi-tenant app consented in your tenant, cut its permissions to what it uses, and watch service principal sign-ins as closely as you watch human ones.

This week Censys added the second half of the story. It counted 1,465 internet-exposed ARTEX consoles as of early November, and the tool's author has said it will go closed-source while copies keep circulating.

What Storm-0940 Actually Did With ConnectWise

Storm-0940 used ConnectWise's own application identities to log in to customer tenants as a trusted app. Attackers compromised credentials tied to ConnectWise Cloud Backup (formerly SkyKick), which let the app obtain Microsoft Graph tokens in customer tenants without a user sign-in, so no password or MFA challenge was ever involved. Huntress counted suspicious sign-ins across 162 tenants by 19:00 UTC on October 16.

From there the sequence was standard cloud tradecraft, run quickly. Huntress saw ConnectWise Cloud Management service principals assign themselves directory roles, mostly Exchange Administrator, in nearly 50 monitored tenants. In one tenant the Cloud Management for Microsoft Teams app granted itself Global Administrator and added credentials to two other apps, one of them Huntress's own. That took about five minutes.

Microsoft's report fills in the rest. After authenticating, the actor ran Graph reconnaissance, changed application credentials for persistence, tried to alter identities, groups and privileged roles, and in some environments read secrets in bulk across multiple Key Vaults. Microsoft says most targeting failed, and that an affected app or a successful authentication "does not necessarily indicate that customer data was accessed or exfiltrated."

ConnectWise disabled seven application identities on October 17 and took Cloud Backup, SaaS Security and Cloud Management offline. As of its October 19 update it had no restoration timeline and said existing backup archives "remain encrypted and isolated."

---

What ARTEX Is and Why It Changes Your Detection Math

ARTEX is an open-source, multi-agent penetration testing framework that drives reconnaissance through exfiltration with an LLM. Censys traces it to a GitHub repository, Autumn-27/ARTEX, published on July 26, 2026 under AGPL-3.0. It uses Planner and Worker agents, keeps an asset graph of what it has found, and plugs into Anthropic, OpenAI or any OpenAI-compatible endpoint. It drew an estimated 1,500 to 2,000 GitHub stars in ten weeks.

Microsoft's description is the part that matters for your SOC: ARTEX agents carry out tests "from reconnaissance through data exfiltration with little needed human interaction", and the speed leaves defenders "little time to detect and respond." In a separate Storm-0940 password spray from October 10 to 14, Microsoft logged more than 151,000 failed logons against 327 accounts at eight organisations, peaking at 2,900 failures a minute. That spray produced no successful sign-in. The app-credential route did.

ConnectWise was not the first ARTEX campaign. CrowdStrike tied it on October 7 to a suspected financially motivated, Chinese-speaking actor who hit South Korean financial firms from late September, running DeepSeek v4.1-flash as the main model with GLM-5.3 and Grok 4.6 alongside (see our xAI Grok page). A fresh round of incidents at Daishin Securities, Mirae Asset and Bithumb followed in late October, though TechCrunch notes no one has said ARTEX was used in those.

The fair objection is that none of this is new technique. Stolen app secrets, weak passwords and missing MFA explain most of it, and TechCrunch reports that many ARTEX-linked attacks exploited weak or known passwords and a lack of multi-factor authentication. That is correct. What the agent added was volume: it ran the old attacks across thousands of tenants faster than a triage queue built for human attackers can turn over. If your detection SLA for a privileged role change is "next business day," that SLA was written for a different adversary.

Why Conditional Access Will Not Save You Here

Entra Conditional Access for workload identities does not cover the apps that were abused. Microsoft's documentation says policy applies to single-tenant service principals registered in your tenant, and "Microsoft and third-party SaaS applications, including multitenant apps, are not covered by these policies." Where it does apply, it needs Workload Identities Premium licences and offers one grant control: block.

So the location-based block you might reach for first, "only allow this app from the vendor's IP ranges," is not available for a ConnectWise-style app in your tenant. Your controls are the permissions you consented, the roles the app can reach, and how fast you see it use them.

Two more limits show up in the incident reporting. Disabling an app stops new tokens, but previously issued access tokens stay valid until they expire, and revoking user sessions does nothing to application access. Disabling also does not undo changes already made: a role the app assigned itself, or a secret it added to another app, stays until you remove it.

The vendor-side control worth asking about is app instance property lock, which stops credentials being added to an app's service principal in customer tenants. Microsoft says it has been enabled by default for new applications since June 2026. Older apps from MSP and backup vendors may predate that default, and only the vendor can turn it on.

---

What 1,465 Exposed Consoles Tell You

The Censys census shows ARTEX is now commodity infrastructure, much of it run carelessly. Of the 1,465 hosts, about 650 sit in two identically configured hosting blocks, leaving roughly 815 distinct-looking deployments. The United States hosts 726, Hong Kong 387 and China 177. Censys found 155 hosts also running other threats it tracks, including Cobalt Strike, Vshell and Adaptix C2, and some exposed open directories holding exploit binaries and implants.

Not every console belongs to an attacker. Censys researcher Silas Cutler told TechCrunch that many belong to authorized testers. That cuts both ways for you. If your own red team or a pentest vendor runs ARTEX, its console may be one of the exposed ones, holding your scope documents and test accounts.

The original repository is down, but archived copies and rebrands such as ScopeWeaver still circulate. The closed-source move changes who gets updates. It does not withdraw the code already forked.

Monday Actions for Identity and Security Leads

This Week:

1. Inventory multi-tenant apps by application ID, not display name. Microsoft's guidance is to search by app ID across every tenant where an app was installed or authorized. If you run ConnectWise products, start with Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae) and Cloud Management for Microsoft Teams (24205314-2b89-4e07-a2a4-579e898a5640), and keep them disabled until ConnectWise issues restoration instructions.
2. Preserve before you delete. Microsoft says not to delete enterprise applications as a first response. Export Entra sign-in and audit logs and Purview records, then review service principal sign-ins, successful and failed, back to October 1.
3. Audit what the apps changed. Look for credentials added to any app since October 13, new service principals or owners, app-role assignments, consent grants, Conditional Access edits and privileged role assignments made by a service principal. A backup app that assigned itself Exchange Administrator is your answer.
4. Run Microsoft's Key Vault hunt. Its query flags any identity with at least 20 successful SecretGet events across at least 3 vaults in 15 minutes. Rotate anything those identities read.

This Month:

1. Cut standing permissions on every third-party app. Microsoft assessed that the attacker likely abused existing permissions, including Directory.ReadWrite.All, on a backup tool. Ask each vendor which Graph permissions the product actually calls, and remove the rest.
2. Page on service principal role changes. Route the Defender alert "Application self-assigned Global Administrator role" and any directory role assigned by a service principal to an on-call human with a minutes-level response target, not a daily review queue.
3. Ask your MSP and backup vendors two questions in writing: is app instance property lock enabled on the apps in your tenant, and how would they rotate a shared multi-tenant credential across customers within an hour?
4. Hunt for ARTEX in your own estate. Censys flags consoles by an HTML title beginning "ARTEX" plus Next.js static assets, default port 8787, often next to LLM proxy software such as CLIProxyAPI or New API. If you find one, establish whether it is a sanctioned test. If it is, take it off the internet.

The Bottom Line

OAuth app abuse is an old problem, and the agent mostly removed the time it used to take. The pattern is familiar from earlier cycles: an offensive tool is published for authorized testing, gets popular, and becomes standard kit for people who never asked permission. We covered the credential side of this in the Wiz Black October breaches and the privilege side in our guide to agent authorization and standing privilege. The model-capability side looks less alarming than the headlines: OpenAI's own testing found GPT-6 Cyber had no wins against fully hardened targets. Hardening still works. It now has to be in place before the attacker arrives, because detection and response no longer get a day to catch up.

Your third-party apps are non-human identities with admin-adjacent grants and no lifecycle, the problem we described in the Adobe-Rilo token story. Pull the list of multi-tenant apps in your tenant, sorted by the Graph permissions each one holds, and start at the top.

Continue Reading

• Rotate Your Bedrock Keys If You Used These Nine AI Platforms
• Agent Authorization: Standing Privilege Is the Whole Problem
• Okta vs Entra Agent ID vs SailPoint: Two Issue, One Governs
• GPT-6 Cyber Tests Found No Wins on Fully Hardened Targets
• Copilot Memory Survives Your Password Reset. Go Purge It.
• Adobe Took Rilo's Team. Its Slack Token Never Expires.