Cutsign — draft: Storm-0940/UNC7228 ARTEX agentic intrusions: ConnectWise M365 abuse plus wider on-prem and cloud TTPs

AI-generated draft, unreviewed. Version 1, written by a model from the stored public sources on 2026-11-02; hype score 0. It is regenerated when the evidence changes and is published as a verdict card under /cards/ once it crosses the publish bar. Status: superseded.

Storm-0940/UNC7228 ARTEX agentic intrusions: ConnectWise M365 abuse plus wider on-prem and cloud TTPs

Hunt / IR + hardenP1confidence: highre-issue of card connectwise-m365-2026

Stolen ConnectWise Cloud Backup app credentials were used against 2,250+ M365 tenants from Oct 15, and GTIG now links the same ARTEX tooling to intrusions beyond ConnectWise since late August. Today: hunt the ConnectWise app identities and Entra audit back to Oct 1, then run the new MySQL-webshell and webhook.site egress hunts.

Triage: Microsoft and Huntress confirm privileged access in M365 tenants via a vendor app identity in under three hours [S2][S4]; any tenant that used ConnectWise Cloud Backup should treat a hit as an active compromise.

Microsoft [S2] and Google GTIG/Mandiant [S1] are primary sources and confirm the core claims; Huntress [S4] corroborates with its own telemetry. The CrowdStrike 'Vapor Panda' attribution named in the change notice has no source in this input.

Changed since version 0

new_source 2026-11-02: New reporting attributes ARTEX-driven attacks against 200+ organizations to a campaign tracked as Vapor Panda (CrowdStrike), including forged admin tokens and m

What happened

Microsoft attributes the ConnectWise Cloud Backup supply chain compromise to China-aligned Storm-0940, using the ARTEX agentic AI framework [S2].
The actor password-sprayed (151,000+ failures, Oct 10-14), then used stolen ConnectWise app identities to authenticate to 2,250+ M365 tenants from Oct 15 [S2].
Follow-on activity: Graph reconnaissance, secrets/certificates added to app identities, and the Teams service principal assigning itself Global Administrator, reaching privileged access in under three hours [S2][S4].
GTIG/Mandiant track PRC-nexus UNC7228, which overlaps Storm-0940, and financially motivated groups using ARTEX, PentAGI, CAIRN and Hexstrike in real intrusions since late August 2026, with confirmed compromise and data theft [S1].
With supplied valid credentials, ARTEX probed AWS/Azure permissions, turned MySQL general_log into JSP webshells, abused Kudu APIs, ran Kerberoasting/DCSync scripts and posted output to rotating webhook.site URLs via curl [S1].

Timeline

2026-08 (late)	Agentic frameworks including ARTEX first seen in real intrusions [S1]
2026-10-10 to 2026-10-14	Password spray, 151,000+ failures [S2]
2026-10-15	Stolen ConnectWise app identities used against 2,250+ M365 tenants [S2]
2026-10-21	Microsoft publishes Storm-0940/ARTEX attribution and hunting guidance [S2]
2026-10-27	Huntress details escalation across ~1,000 monitored tenants [S4]
2026-11-02	GTIG/Mandiant report UNC7228 (overlaps Storm-0940) and other actors using agentic frameworks [S1]

Detect

Entra app credential, role and principal changes · Entra ID directory audit logs

index=* earliest="10/01/2026:00:00:00" operationName IN ("Add service principal credentials","Update application – Certificates and secrets management","Add member to role","Add app role assignment to service principal","Remove service principal","Consent to application") | stats count min(_time) as first max(_time) as last values(operationName) as ops by initiatedBy.app.displayName, initiatedBy.app.servicePrincipalId | sort - count

A hit means: A service principal added credentials, granted roles (including to itself) or deleted a principal. A vendor or Teams principal assigning itself Global Administrator matches the pattern in [S2][S4].

Vendor app sign-ins with scripted user agents or listed IPs · Entra service principal sign-in logs; Microsoft Graph activity logs

index=* earliest="10/01/2026:00:00:00" (userAgent="Python-urllib/3.12*" OR userAgent="curl/7.88.1*" OR userAgent="python-requests/2.31*" OR ipAddress="144.172.64.*") | stats count min(_time) as first max(_time) as last values(userAgent) as ua values(ipAddress) as ip by appId, servicePrincipalName

A hit means: An app identity authenticated or called Graph with tooling that deviates from the ConnectWise baseline (kiota-dotnet) or from the reported IP range [S4]. Check appId against the ConnectWise IDs in [S2].

MySQL general_log webshell and ARTEX artifacts · MySQL general/query log; web server access log; EDR file creation

index=* ("SET GLOBAL general_log_file" OR "cl1217.jsp" OR "f1219a.jsp" OR "z1219.jsp" OR "artex-probe-" OR "ArtexProbe") | stats count min(_time) as first max(_time) as last values(source) as sources by host

A hit means: The MySQL log was redirected to a file, a reported webshell name was requested, or ARTEX naming artifacts were created. Any of these warrants host-level investigation [S1].

Server egress to webhook.site · Proxy, DNS, network flow

index=* ("webhook.site" OR query="*webhook.site" OR url="*webhook.site*") | stats count dc(url) as distinct_urls values(http_user_agent) as ua min(_time) as first max(_time) as last by src

A hit means: A host contacted webhook.site. Many distinct URLs from a server, especially with a curl user agent, matches the C2 and exfil pattern in [S1].

Verify

Confirm the appId belongs to a ConnectWise Cloud Backup identity listed in [S2] and that the activity is not a ConnectWise-initiated change on record.
Benign look-alike: admins or automation adding app secrets during routine rotation; check the initiator, ticket and timing.
Benign look-alike: developers or CI jobs using curl/Python against Graph or webhook.site for testing; a server or database host doing it is not routine.
Benign look-alike: DBAs enabling general_log for troubleshooting; a log file path ending in .jsp in a web-served directory is not benign [S1].
For short bursts of cloud API calls (GTIG cites 27 events in 23 seconds), compare against known scanners and IaC pipelines [S1].

Scope

Affected

M365 tenants where ConnectWise Cloud Backup app identities were present [S2][S4]
Environments where an attacker holds valid credentials: accounts, SAS tokens, service principals, Kudu publishing credentials, IAM keys [S1]

Only if

Attacker holds valid credentials or a vendor app credential [S1][S2]
Internet-exposed management interfaces (e.g., Azure Kudu/SCM) or application SQL APIs [S1]

Not affected if

None stated by the sources.

Enumerate

All service principals and app registrations tied to ConnectWise, including credentials added since Oct 1
Every role assignment granted to a service principal since Oct 13
Principals deleted since Oct 13 (Huntress saw the original principal removed) [S4]
Internet-facing MySQL-backed web apps and Azure App Service/Kudu endpoints [S1]
AWS key pairs, Elastic IPs and t3.micro instances created outside change records [S1]
AD accounts created or reset with ArtexProbe-style names [S1]

Contain

Preserve Entra sign-in, audit and Graph activity logs and CloudTrail before changes; default retention may not reach back to Oct 1.
Disable or remove ConnectWise app identities and revoke their credentials and consents; re-adding consent later is possible but rotated secrets cannot be restored.
Remove privileged roles from service principals that self-assigned or received them since Oct 13.
Block server egress to webhook.site [S1].
Isolate hosts with JSP webshells or ArtexProbe artifacts after imaging.
If DCSync is suspected, plan a double krbtgt reset; this invalidates Kerberos tickets domain-wide and cannot be undone [S1].

Eradicate

Remove secrets/certificates added to app identities and sibling principals [S2][S4].
Delete JSP webshells written via MySQL general_log and restore the log settings [S1].
Delete ArtexProbe-named accounts and reset passwords changed by the actor [S1].
Terminate actor-created EC2 instances, key pairs, Elastic IPs and volumes [S1].
Rotate Kudu publishing credentials, SAS tokens and IAM keys the actor could have held [S1].
Rotate service account passwords exposed to Kerberoasting [S1].

Recover

Before re-enabling any vendor app, confirm it has no added credentials and only the permissions the vendor documents.
Validate role assignments against a known-good baseline.
Monitor service principal sign-ins for non-baseline user agents and IPs [S4].
Monitor control-plane API bursts, credential additions, account creation bursts and new webhook/OAST egress [S1].

Re-enter the loop when

A sourced CrowdStrike report on Vapor Panda is obtained and adds IoCs, victims or TTPs.
Microsoft or ConnectWise updates the app ID list, IP list or tenant count.
GTIG or others publish further ARTEX IoCs or new victim sectors.
Any hit on a non-ConnectWise app identity, showing wider credential abuse.
Evidence of DCSync or AD CS abuse on an internal domain.

Debrief

Record which ConnectWise identities existed, when they were removed, and earliest/latest suspicious activity.
Record log retention gaps that limited the lookback to Oct 1.
Gap: sources do not say how the ConnectWise app credential was first obtained beyond the spray.
Gap: sources do not give remediation steps from ConnectWise itself.
Gap: the UNC7228/Storm-0940 overlap is stated by GTIG as overlap, not identity [S1].

Detection coverage — checked automatically

Category	Source	Status
Vendor	Impacted vendor / CERT advisory	published — primary source among the thread's sources: https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
Government	CISA KEV	not checkable — no CVE: the catalog is keyed by CVE
EDR / endpoint VM	CrowdStrike blog	published — VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign (names ARTEX in the title; the feed text carries no CVE id)
EDR / endpoint VM	Microsoft Security blog	published — AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise · Tracking AI adoption in North Korean threat actor tradecraft (names ARTEX in the title; the feed text carries no CVE id)
EDR / endpoint VM	SentinelOne blog	published — The Good, the Bad and the Ugly in Cybersecurity - Week 43 (2026) (names the campaign in the title; the feed text carries no CVE id)
EDR / endpoint VM	SentinelOne Labs	nothing found — no post names it among the feed's 10 newest items
WAF / edge	Akamai blog	published — What ARTEX Reveals About Overlooked Attack Surfaces (names ARTEX in the title; the feed text carries no CVE id)
WAF / edge	Cloudflare WAF managed-ruleset changelog	nothing found — no post names it among the feed's 136 newest items
Cloud / container	Wiz blog	published — ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors (names ARTEX / Storm-0940 in the title; the feed text carries no CVE id)
IDS / research	Cisco Talos blog	published — Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer · NIK C2: The new AI-enabled command-and-control framework (names the campaign in the title; the feed text carries no CVE id)
Detection content	Elastic detection rules	published — 21 files name ARTEX / ConnectWise: rules/_deprecated/exfiltration_rds_snapshot_export.toml, rules/integrations/aws/exfiltration_rds_snapshot_export.toml, rules/network/persistence_mysql_udf_injection.toml, rules/network/impact_destructive_mongodb_command.toml
Detection content	Elastic Security Labs	nothing found — no post names it among the feed's 102 newest items
Detection content	SigmaHQ rules	published — 19 files name ARTEX / ConnectWise: rules-compliance/other/netflow_cleartext_protocols.yml, rules/network/firewall/net_firewall_cleartext_protocols.yml, deprecated/windows/file_event_win_access_susp_teams.yml, rules/windows/file/file_event/file_event_win_hktl_nppspy.yml
Detection content	Splunk ESCU	published — 16 files name ARTEX / ConnectWise: stories/use_of_cleartext_protocols.yml, detections/network/protocols_passing_authentication_in_cleartext.yml, removed/investigations/get_notable_history.yml, removed/investigations/get_process_information_for_port_activity.yml
MSSP / IR firms	Arctic Wolf blog	nothing found — no post names it among the feed's 10 newest items
MSSP / IR firms	Huntress blog	published — AI, Scripts, Operator: Inside the ConnectWise Attack · ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks (names ConnectWise in the title; the feed text carries no CVE id)
MSSP / IR firms	Rapid7 blog	published — Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779 (names the campaign in the title; the feed text carries no CVE id)
MSSP / IR firms	Sophos threat research	published — ConnectWise Cloud Backup application abused in cross-tenant token sweep (names ConnectWise in the title; the feed text carries no CVE id)
Research	Unit 42	nothing found — no post names it among the feed's 15 newest items

Checked automatically 2026-11-03 19:00Z from public sources: 13 published, 5 nothing found, 1 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

What a person would still look up (5)

Identity / CASB	Whether service principal self-role-assignment and vendor app credential additions raise alerts.
SIEM	Whether Entra service principal sign-ins and Graph activity logs are ingested and retained back to Oct 1.
EDR	Whether database servers spawning curl/PowerShell and java writing .jsp files are visible.
Secure web gateway / DNS	Whether server egress to webhook.site and similar services is logged and blockable.
Cloud security posture	Whether CloudTrail and Azure Activity bursts and new key pairs/Elastic IPs are alerted.

Exposure queries — generated automatically

No CVE in this campaign: nothing an internet scanner keys on. Scope by product in your own tool.

Banner spellings: a model read 1 from the NVD names and this card's text (former and marketing names, console titles); 0 matched something on Shodan and are shown above, the rest was dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-03 19:00Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

The change notice cites CrowdStrike tracking 'Vapor Panda' across 200+ organisations with forged admin tokens; no CrowdStrike source is in this input, so it is not in the card.
The prior card stated ex-customers should also be hunted 'per Sophos'; no Sophos source is in this input. Confirm before keeping.
The prior card said 'seven appIds'; confirm the count against [S2].
The story says agentic tooling was seen against finance in Asia; confirm that sector detail in [S1].
Does ConnectWise publish its own advisory or customer guidance?

Sources

[S1] https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks/ · Google Cloud Blog
[S2] https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/ · Microsoft
[S3] https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html · The Hacker News
[S4] https://www.huntress.com/blog/connectwise-attack-ai · Huntress

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.