Microsoft attributes ConnectWise supply-chain attack to Storm-0940
Original title: Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group
The group used ARTEX to reach more than 2,250 tenants at 2,900 sign-in attempts per minute; compromise counts are unstated.
Microsoft Security Research attributed a supply-chain attack on ConnectWise Cloud Backup customers’ Microsoft 365 environments to Storm-0940, which it calls China-state aligned and active since 2021. From as early as September 2026 the group used the open-source agentic framework ARTEX to automate scanning, password spraying and OAuth abuse. A four-day spray ending October 14 targeted 327 accounts at eight organizations and produced more than 151,000 failed logons. ConnectWise began phased service restoration Wednesday and told customers to keep connections disabled.
Unconfirmed: Microsoft did not say how many customers were compromised and said successful sign-in does not prove data theft.
- The spray covered Microsoft 365 and Exchange Online accounts and peaked at 2,900 failures per minute.
- AI agents then did Graph reconnaissance, application credential changes and privileged role edits.
- ConnectWise shut services Saturday and expects recovery to take several days.
- Microsoft says other actors in various regions are also using ARTEX.
Impact: Cloud tenant access, persistence and possible data access via a backup app
| Product | Affected |
|---|---|
| ConnectWise Cloud Backup | — |
- 1.Keep ConnectWise Cloud Backup connections disabled until the company finishes restoration.
- Vendors
- ConnectWiseMicrosoft
- Threat actors
- Storm-0940
- Malware
- ARTEX
- Countries
- China
From the original article
3 min read at cyberscoop.com
Storm-0940 used the agentic AI penetration testing framework to automate attacks and “reach more than 2,250 tenants at 2,900 sign-in attempts per minute,” Microsoft researchers said. The post Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group appeared first on CyberScoop.
By Matt Kapko · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.