Storm-0940 used ARTEX in ConnectWise Cloud Backup supply-chain attack
Original title: China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
Microsoft says the agents targeted more than 2,250 tenants at up to 2,900 sign-in attempts per minute.
Microsoft said China state-aligned Storm-0940 compromised ConnectWise Cloud Backup and used the Go-based ARTEX framework to scan, password-spray, and abuse OAuth apps at customer tenants. Since September 2026 the activity has targeted hundreds of organizations worldwide. A spray from 144.172.64.99 on October 10–14 logged over 151,000 failures and no successes; on October 15 agents signed in with stolen ConnectWise application identities and, in some cases, changed credentials and privileges. ConnectWise is restoring services in phases over several days.
Unconfirmed: Microsoft attributes the campaign to China state-aligned Storm-0940, and some later directory actions are assessed rather than fully confirmed.
- October 11 peaked at 2,900 failures per minute and more than 111,000 failures that day.
- The spray hit 327 accounts across eight organizations; 48 accounts exceeded 1,000 failures.
- Microsoft says some intrusions reached privileged cloud access in under three hours.
- ARTEX was made closed-source after abuse against South Korean financial institutions.
- Storm-0940, assessed active since at least 2021, has also used the Quad7 botnet.
Impact: Privileged access to customer cloud tenants via stolen app credentials
| Product | Affected |
|---|---|
| ConnectWise Cloud Backup | — |
- 1.Hunt Microsoft 365 and Exchange sign-ins and OAuth credential changes from 144.172.64.99.
- 2.Rotate ConnectWise cloud application credentials that can persist after the original app is remediated.
- ATT&CK
- T1195 Supply Chain CompromiseT1110.003 Password SprayingT1528 Steal Application Access TokenT1098 Account Manipulation
- Vendors
- ConnectWise
- Threat actors
- Storm-0940
- Victims
- ConnectWise
- Organizations
- Microsoft
- Countries
- ChinaSouth Korea
From the original article
4 min read at thehackernews.com
Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application. During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse against South Korean financial institutions, to speed up scanning and
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.