The lack of source IP addresses in application-only directory event logs has created significant hurdles for forensic investigators tracking cloud-based intrusions. This evidentiary gap became painfully apparent throughout 2026 as organizations grappled with a wave of supply-chain attacks targeting Microsoft 365 environments. One of the most aggressive campaigns has been attributed to Storm-0940, a China-aligned threat actor that specialized in exploiting third-party service credentials. By compromising the authentication materials of ConnectWise Cloud Backup, the actors moved beyond traditional phishing or credential stuffing. Instead, they focused on the inherent trust placed in backup solutions, which require extensive administrative rights to function effectively. The shift toward targeting service principals marks a pivotal evolution in cyber warfare, as it allows attackers to bypass modern defenses like Multi-Factor Authentication with ease, leaving security teams blind to the breach.
The Technical Foundation: Exploiting Delegated Cloud Permissions
The technical core of the Storm-0940 campaign relied on a deep understanding of how delegated permissions function within the Microsoft Entra ID ecosystem. When an organization integrates a service like ConnectWise, it often grants that application broad scopes such as Mail.ReadWrite and Directory.ReadWrite.All to ensure comprehensive data protection. The threat actors recognized that these application-only permissions do not require a user to be present for an access token to be issued. By obtaining the client secrets associated with the ConnectWise service principal, Storm-0940 could programmatically request tokens from the Microsoft Graph API. This method is particularly dangerous because it circumvents conditional access policies that usually trigger MFA for human users. The result is a silent, automated entry point that leverages the very tools designed to protect corporate assets, effectively turning the security infrastructure against itself.
Neutralizing Security Protocols: Bypassing Multi-Factor Authentication
Once the attackers secured the necessary credentials, they initiated a series of automated requests to the Microsoft Graph API to harvest authentication tokens. Because the application was already trusted by the tenant, these requests were processed without any interactive sign-in requirement, rendering standard Multi-Factor Authentication protocols completely ineffective. The attackers then used these tokens to impersonate the backup service, gaining the ability to read, modify, and delete data across the entire organization. This strategy is highly effective for large-scale operations because it allows a single set of compromised credentials to provide access to hundreds of separate tenants simultaneously. Forensic analysis has shown that the actor’s tooling was capable of processing these requests with efficiency, cycling through various API endpoints to map out the directory structure. This level of automation ensures that the attackers can maintain a high tempo while minimizing the footprint.
Visibility Challenges: The Absence of Source IP Telemetry
The reliance on application-only authentication created a unique set of challenges for incident responders who attempted to trace the origin of the breach. In many instances, the directory event logs associated with these token requests did not include the source IP address of the attacker, as the requests were viewed as internal service-to-service communication. This lack of visibility meant that even when suspicious activity was identified, determining the exact entry point or the geographical location of the adversary remained difficult. Furthermore, many organizations did not have advanced Microsoft Graph activity logging enabled, which further obscured the specific actions taken by the threat actor once they were inside the tenant. This environment of limited visibility allowed Storm-0940 to persist within environments for extended periods without detection. The attackers exploited these logging deficiencies to conduct reconnaissance, knowing that the absence of audit trails would delay recovery.
Operational Evolution: The Integration of Agentic AI Frameworks
The most striking development in the Storm-0940 campaign was the integration of the ARTEX framework, an agentic AI system designed to automate complex cyber operations. This technology represents the next phase in the industrialization of cyberattacks, moving away from simple scripts toward autonomous systems capable of real-time decision-making. ARTEX functions by deploying multiple AI agents that can work in parallel to scan discovered environments, identify vulnerabilities, and execute exploit sequences. This multi-agent approach allows the threat actor to manage a massive scale of victim tenants with minimal human intervention. While traditional attacks often stall when they encounter unexpected security configurations, an agentic framework can analyze the obstacle and adjust its strategy on the fly. This capability has led to a dramatic decrease in the time required for an attacker to move from initial access to full domain dominance, forcing defensive teams to rethink their strategy.
Accelerating Intrusions: Reducing Breakout Times with AI
The impact of the ARTEX framework on the speed of operations was significant, as telemetry data showed that some compromises reached highly privileged status in under three hours. This breakout time is significantly shorter than what is typically observed in manual hacking operations, where human actors must pause to evaluate their next steps. By using AI to handle the reconnaissance and privilege escalation phases, Storm-0940 could strike with a level of precision and velocity that overwhelmed traditional monitoring systems. The AI agents were able to identify the most direct path to the Global Administrator role, often using the compromised backup application to assign elevated permissions to other, less-scrutinized service principals. This rapid escalation ensured that by the time an alert was generated, the attackers had already established multiple layers of persistence. The use of AI in this context does not just make the attack faster; it makes the entire lifecycle of the intrusion more resilient.
Strategic Remediation: Future Resilience Against Automated Threats
The response to the Storm-0940 campaign necessitated a comprehensive overhaul of cloud security practices, as traditional password resets proved insufficient against such advanced persistence. Security teams discovered that the attackers had planted secondary backdoors by adding secrets to unrelated applications, meaning that simply disabling the compromised backup service did not fully evict the threat. Forensic investigators emphasized the need for a total audit of all service principals and their associated permissions to ensure that no unauthorized credentials remained. Organizations moved toward implementing stricter least-privilege models for third-party integrations and prioritized the enablement of detailed Graph API logging. The industry learned that defending against agentic AI required a shift toward automated response capabilities that could match the speed of the adversary. Ultimately, the lessons from this breach highlighted that the primary battleground of cybersecurity moved into the realm of identities.
