Storm-0940 used AI tool Artex in ConnectWise customer intrusions
Microsoft logged more than 151,000 failed logons and successful sign-ins with ConnectWise cloud application identities.
80
Threat actor
Storm-0940
- Mentions · 7d14
- Mentions · 30d14
- All mentions14
- First seenOct 21, 2026
- Last mentioned2d ago
Timeline
14 articles · newest firstAINews 'Black October' roundup clusters AI-linked security disclosures
The digest says many incidents were found earlier and disclosed together, while exploitation scale is disputed.
38
Microsoft links ConnectWise breach to Storm-0940 using AI tool ARTEX
Stolen application credentials were used against 2,250 Microsoft 365 tenants, with privileged access in under three hours in some cases.
82
Microsoft links Storm-0940 to ConnectWise Cloud Backup attack
Compromised Cloud Backup application credentials were used to target more than 2,250 Microsoft 365 tenants.
80
Microsoft ties ConnectWise backup abuse to Storm-0940 and ARTEX
Sign-in attempts hit 2,900 a minute, with more than 111,000 failures on October 11 alone.
82
ARTEX-using actor expands targeting of IT and software vendors
The operator password-sprayed engineers, tested unsigned JWTs, and probed cross-tenant access on Okta, Entra ID and Cognito.
76
Storm-0940 used agentic AI against 2,250 Microsoft 365 tenants
After a ConnectWise Cloud Backup compromise, sign-in attempts hit 2,900 a minute and some tenants saw privileged access in under three hours.
82
Storm-0940 used ConnectWise credentials against 2,250 Microsoft 365 tenants
Microsoft says the China-linked group used ARTEX and reached privileged cloud access at some organizations in under three hours.
82
Microsoft says Storm-0940 used AI to breach ConnectWise tenants
The group attempted more than 2,250 tenant sign-ins at about 2,900 per minute, often gaining access within three hours.
82
Storm-0940 used ARTEX and AI coding agents against many targets
Microsoft says the group tried more than 2,250 tenants at about 2,900 sign-ins a minute.
74
Storm-0940 used ARTEX against over 2,250 Microsoft 365 tenants
Stolen ConnectWise application credentials enabled Graph access; a separate spray of more than 151,000 logons had no successful authentication.
76
Storm-0940 used ARTEX in ConnectWise Cloud Backup supply-chain attack
Microsoft says the agents targeted more than 2,250 tenants at up to 2,900 sign-in attempts per minute.
84
Microsoft attributes ConnectWise supply-chain attack to Storm-0940
The group used ARTEX to reach more than 2,250 tenants at 2,900 sign-in attempts per minute; compromise counts are unstated.
82
Storm-0940 used ARTEX AI in ConnectWise supply-chain attacks
Microsoft says privileged cloud access sometimes took under three hours, with more than 2,250 tenants targeted.
84
Appears with
- Microsoft 365product · 12
- ARTEXmalware · 11
- Microsoftvendor · 11
- ConnectWisevendor · 9
- Zscalerorganization · 6
- ConnectWisevictim · 6
- ConnectWise Cloud Backupproduct · 6
- CrowdStrikeorganization · 4
- GLMai model · 3
- Microsoftorganization · 3
- Artexproduct · 3
- Grokai model · 3
- Recorded Futureorganization · 3
- Cloud Backupproduct · 2
- DeepSeekai model · 2
- Microsoft Graphproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.