Storm-0940

Storm-0940 is a threat actor name assigned by Microsoft to a state-linked hacking group that has been observed using stolen credentials and password-spraying techniques, where attackers try common passwords across many accounts at once, to gain access to corporate cloud and email systems. The group has been associated with operations targeting government, defense, and technology organizations, and has been linked to compromised credentials used against cloud services. For compliance and risk teams, the relevant lesson is that a single reused or weak password can give an attacker a foothold in an AI-enabled environment, so strong authentication and credential monitoring belong in any vendor-risk and access-control program.

1 item

Corporate PolicyGlobal2026-10-23

State-Linked AI Attack Hit 2,250 Microsoft 365 Tenants via Trusted App Identities

Microsoft Threat Intelligence linked a large-scale cloud intrusion to Storm-0940, a China-state-aligned hacking group. The attackers used an open-source agentic AI tool called ARTEX to automate credential attacks at 2,900 attempts per minute across more than 2,250 Microsoft 365 tenants. They entered through a breached cloud backup provider and gained privileged access within three hours by impersonating trusted third-party application identities.

agentic AI non-human identity cloud security Microsoft 365 Storm-0940 credential attacks third-party risk China