Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-10-21

HighPrimary

Storm-0940 Used ARTEX Agents for Downstream Tenant Access After the ConnectWise Compromise

Microsoft reports that Storm-0940 used ARTEX to automate offensive activity and, after the ConnectWise Cloud Backup compromise, attempted sign-ins to more.

ARTEX / Storm-0940Governance bypassReported agent authority-boundary failureCompromised application identity, Microsoft Graph and tenant directory boundaries

What happened

Using stolen application identities for tenant sign-ins and follow-on Graph and directory operations

Why it matters

Follow-on activity was observed in multiple customer environments; the 2,250-plus figure is attempted tenant reach, not confirmed breaches or data theft.

Missing authorization check

Independent authorization for using stolen application identities for tenant sign-ins and follow-on Graph and directory operations

Would PP block it?

An independently enforced gate in the agent operator's own environment could bind consequential actions to an approved target and task. That is a deployment condition, not protection supplied to an unwilling third-party target.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-10-21

    The cited source discloses the behavior documented in this record.

Technical breakdown

  • Microsoft reports that Storm-0940 used ARTEX to automate offensive activity and, after the ConnectWise Cloud Backup compromise, attempted sign-ins to more than 2,250 tenants with stolen application credentials. In some customer environments agents progressed to Microsoft Graph reconnaissance, application credential modifications and identity or privilege changes. Microsoft cautions that authentication does not establish data access or exfiltration. A separate high-volume password spray produced no observed successful authentication.
  • Using stolen application identities for tenant sign-ins and follow-on Graph and directory operations
  • Follow-on activity was observed in multiple customer environments; the 2,250-plus figure is attempted tenant reach, not confirmed breaches or data theft.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Governance bypass. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Compromised application identity, Microsoft Graph and tenant directory boundaries
Still needs
PP is not a perimeter defense and cannot stop an outside agent using its own tools or stolen credentials against an unintegrated service. Patching, identity controls, isolation and network restrictions remain necessary.
Receipt required for
Using stolen application identities for tenant sign-ins and follow-on Graph and directory operations

An internal gate at the affected organization cannot constrain an externally operated agent that does not route its actions through that gate.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop