Audit Microsoft 365 App Grants After Storm-0940's ConnectWise Attack
Storm-0940 ran the ARTEX agent framework with stolen ConnectWise app credentials against more than 2,250 Microsoft 365 tenants, and Censys now counts 1,465 exposed ARTEX consoles. Entra Conditional Access does not cover third-party multi-tenant apps, so the fix is permissions and fast alerting.
November 7, 2026 · 8 min read