What happened
On Oct 21, Microsoft published an analysis of China-state-aligned Storm-0940 using ARTEX, an open-source multi-agent LLM penetration-testing framework, to automate attacks against hundreds of organizations from September 2026 — reaching privileged cloud access in under 3 hours in some cases and driving the ConnectWise supply-chain compromise. It documents AI-accelerated OAuth application abuse and Microsoft Graph follow-on activity, with Defender XDR detections and hunting queries.
Why it matters
A documented real-world case of off-the-shelf agentic AI being used to scale offensive operations (recon, password spraying, OAuth abuse) at machine speed, compressing time-to-privilege and reducing defense reaction windows. It is a reference threat model for AI-enabled attacks and a signal for defenders to secure OAuth application credentials and M365 app access.
Applicability
Security teams, especially those running M365/Entra, should apply the published hunting queries and review service-principal sign-ins and unexpected application credential/privilege changes.