Microsoft says Storm-0940 used AI to breach ConnectWise tenants
Original title: Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants
The group attempted more than 2,250 tenant sign-ins at about 2,900 per minute, often gaining access within three hours.
Microsoft says China-aligned Storm-0940 used the ARTEX agentic penetration-testing framework to compromise Microsoft 365 tenants used by ConnectWise and then target downstream customers. The campaign, dated to September 2026, sought data theft and reached hundreds of organizations across many industries. ConnectWise took Cloud Backup, SaaS Security, and Cloud Management offline after discovering unauthorized access on October 17. It has started a phased Cloud Backup restoration and says backup archives and its other products show no evidence of compromise.
Unconfirmed: ConnectWise says backup archives and its other products show no evidence of compromise.
- Storm-0940, active since 2021, adds credentials to existing OAuth applications for cloud persistence.
- Microsoft found reconnaissance, application-credential changes, and privileged-role changes in customer environments.
- ConnectWise first identified suspicious network activity on October 15.
- Customers should review Microsoft 365 tenants and keep affected connections disabled pending instructions.
- CrowdStrike separately reported ARTEX use against South Korean financial organizations in October 2026.
Impact: Privileged access to ConnectWise and downstream cloud tenants
| Product | Affected |
|---|---|
| ConnectWise Cloud Backup | — |
| ConnectWise SaaS Security | — |
| ConnectWise Cloud Management | — |
- 1.Review Microsoft 365 tenants for unauthorized changes or persistent access.
- 2.Keep affected ConnectWise connections disabled until formal restoration instructions apply.
- ATT&CK
- T1110.003 Password SprayingT1190 Exploit Public-Facing ApplicationT1098.001 Additional Cloud CredentialsT1199 Trusted Relationship
- Vendors
- Microsoft
- Threat actors
- Storm-0940
- Malware
- ARTEX
- Victims
- ConnectWise
- Organizations
- CrowdStrike
- Countries
- ChinaSouth Korea
From the original article
3 min read at infosecurity-magazine.com
Microsoft said it has observed threat actor activity in multiple ConnectWise customer environments, with the attackers leveraging the ARTEX agentic AI platform
By James Coker · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.