Storm-0940 ARTEX attacks: ConnectWise app abuse and Okta sign-ups

TL;DR

• On October 21, 2026, Microsoft reported that Storm-0940 used the ARTEX AI attack framework against hundreds of organizations.
• A stolen ConnectWise Cloud Backup (formerly SkyKick) app credential let the actor sign in to customer Microsoft 365 tenants as the app, with no MFA prompt.
• ConnectWise’s fix doesn’t remove secrets planted on other apps in affected tenants.
• Expel saw the same Storm-0940 infrastructure scan a customer’s internet-facing infrastructure and abuse its Okta self-service registration, with no ConnectWise app involved.

How the Storm-0940 ARTEX campaign works

ARTEX uses LLM agents to run attacks with little human involvement. According to Microsoft, Storm-0940 has used it against hundreds of organizations across many industries since September 2026. In multiple cases, the time from initial targeting to privileged cloud access was under three hours. ARTEX isn’t a vulnerability, so there’s nothing to patch. It speeds up familiar techniques like password spraying and OAuth app abuse.

ConnectWise Cloud Backup app compromise

Microsoft assesses Storm-0940 was behind the ConnectWise Cloud Backup compromise. A stolen app credential was used to sign in to customer Microsoft 365 tenants as the app, with no MFA prompt. In tenants Huntress reviewed, a ConnectWise Cloud Management app gave itself Global Admin and planted new secrets on other apps in the tenant.

Huntress hasn’t tied that step to the same operator behind the Storm-0940 sign-ins, though Microsoft’s report attributes app credential and privileged role changes to Storm-0940. By October 17, 2026, Huntress had seen sign-in activity from 144.172.64[.]128 in almost 1,000 Entra tenants, more than 300 of them successful.

ConnectWise disabled seven app identities on October 17, 2026, and says the stolen credential is no longer valid, though previously issued access tokens may stay usable until they expire. That doesn’t clean up affected tenants. Secrets planted on other apps keep working until someone removes them.

Okta self-service registration abuse (observed by Expel)

The target set is wider than ConnectWise customers. Our SOC investigated activity from Storm-0940 infrastructure (144.172.64[.]99) against a customer’s Okta tenant from October 13, 2026, at 07:52 UTC to October 14 at 00:35 UTC. No ConnectWise app was involved, and no existing accounts were compromised. Instead, the attacker:

• Used Okta self-service registration to create five accounts of its own, then enrolled Okta Verify on three of them, each within about a minute of activating the account
• Completed 50 successful SSO sign-ins into production and staging apps from one of those accounts, with more than 100 OAuth access and ID tokens issued
• Tried username enumeration, about 150 failed OAuth/OIDC authorization and token requests across 10+ client IDs
• Ran a password spray against Microsoft 365 WS-Fed, Okta token, device authorization, and other sign-in endpoints, which Okta ThreatInsight blocked (all 21 attempts)

The shared IP is our only link to Storm-0940, and this activity alone doesn’t prove ARTEX was used. We haven’t seen this self-registration tradecraft in public reporting yet.

How to detect Storm-0940 ARTEX activity

• Search for the Storm-0940 IPs in every identity source. Check Okta, Duo, Entra ID, and Google Workspace, not just Microsoft 365.
• Look for app credential changes. Flag secrets or certificates added to any app since October 13, 2026, that you didn’t create, plus any app assigning itself Global Admin.
• Watch Okta self-service registration. New self-registered accounts that quickly enroll Okta Verify and start SSO sign-ins match what we saw.
• Use user agents as supporting evidence only. Python-urllib/3.12, python-requests, and curl match common legitimate tools. Huntress found the ConnectWise Cloud Management and Partner Center apps it reviewed call Graph with kiota-dotnet, so a Python user agent on one of those apps is the anomaly. In the Okta activity, most successful sign-ins used Python-urllib/3.12, and we also saw python-requests/2.34.2, curl/7.88.1, and a bare Mozilla/5.0.
• Don’t trust a clean audit log on its own. Microsoft Graph directory reads leave no Entra audit record, and Graph activity logs only capture them if they were already turned on. A quiet log doesn’t rule out access.

How to mitigate Storm-0940 ARTEX attacks

1. If any Microsoft 365 tenant you own has ever had a ConnectWise Cloud Backup, SkyKick, or Cloud Management app, disable it. Make sure you don’t delete it so you can hold onto the evidence. Keep it disabled until ConnectWise publishes reconnection instructions.
2. Review secrets and certificates on all apps in the tenant, and remove anything added since October 13, 2026, that you didn’t create.
3. If you use Okta self-service registration, review accounts created since October 13, 2026, and any Okta Verify enrollments on them.
4. Hunt for the IOCs below across every identity provider you use.

How Expel detects Storm-0940 activity

Our detections for suspicious user agents at login flagged the Okta activity described above on October 13. Once Microsoft published its indicators on October 21, we matched them to that activity and confirmed it was part of this campaign. The indicators show up in identity logs we already collect (Okta, Entra ID, and Microsoft 365), so we scanned every customer environment for the known Storm-0940 IPs. Those scans are complete; they turned up one confirmed incident. One other match was authorized research activity, not an attack.

Our threat hunters and researchers are building behavior-based hunts and new detections, because the infrastructure behind these IPs changes and an IP scan alone won’t catch everything. If you’re a customer and have questions, or want help assessing your exposure, reach out to our team.