Search — “Storm-0940”

GTIG and Mandiant report PRC-nexus UNC7228 (overlaps STORM-0940) and financially motivated groups operating open-source agentic pentest frameworks (ARTEX, PentAGI, CAIRN, Hexstrike) in real intrusions since late August 2026, with confirmed compromise and data theft. ARTEX used supplied valid credentials to probe Azure/AWS permissions, poison MySQL general_log into JSP webshells, abuse Kudu APIs, Kerberoast/DCSync, and post output to rotating webhook.site URLs via curl. Hunt for 2–25 second bursts of API calls, artex-probe-*/ArtexProbe artifacts, MySQL SET GLOBAL general_log_file changes, and server egress to webhook.site.

Huntress details activity on Oct 15 where a compromised ConnectWise Cloud Backup application credential was used against ~1,000 Huntress-monitored M365 tenants (Microsoft counts 2,250+), attributed by Microsoft to Storm-0940 using the ARTEX AI agent framework. The actor added secrets/certificates to application identities, had the Teams service principal assign itself Global Administrator, granted roles to sibling principals, and deleted the original principal, reaching privileged access in under three hours. Hunt Entra sign-in and directory audit logs for service principals self-assigning privileged roles, credential additions to vendor apps, and vendor apps deviating from baseline user agent (kiota-dotnet) e.g. Python-urllib/3.12, curl/7.88.1, python-requests/2.31 from 144.172.64.x.

Microsoft attributes the ConnectWise Cloud Backup supply chain compromise to China-aligned Storm-0940, which used the ARTEX agentic AI framework to password-spray (151,000+ failures, Oct 10-14) and then abuse stolen ConnectWise app identities to authenticate to 2,250+ M365 tenants from Oct 15. Follow-on Graph activity included reconnaissance, application credential additions for persistence, and privileged role changes (including app self-assignment of Global Administrator). Hunt service-principal sign-ins for the ConnectWise app IDs back to Oct 1, Entra audit for credential/role/consent changes, and the listed IPs and Python/curl user agents.