Storm-0940 abused ConnectWise backup credentials in Microsoft 365
Original title: Hackers Abuse ConnectWise Cloud Backup Credentials to Launch AI-Driven Microsoft 365 Attacks
Microsoft says more than 2,250 tenants were targeted; Huntress confirmed hundreds of sign-ins but not data theft or ARTEX use.
Attackers used compromised ConnectWise Cloud Backup application credentials to request Microsoft Graph tokens in customer tenants without an interactive sign-in or MFA prompt. Microsoft attributed the activity to China-aligned Storm-0940 and said the open-source ARTEX framework accelerated follow-on attacks. In two tenants Huntress investigated, a ConnectWise Teams application assigned itself Global Administrator and added secrets to other applications. Successful authentication does not show that data was stolen.
Unconfirmed: Huntress does not independently confirm ARTEX, and neither account establishes data exfiltration.
- Huntress first disclosed the abuse on October 16, 2026.
- On October 15, 144.172.64.128 touched nearly 1,000 monitored tenants, with over 300 sign-ins.
- Planted application secrets could survive containment of the original vendor app.
- Huntress rates LLM involvement low-to-medium from telemetry alone.
- Requests continued for 22 minutes after a Teams service principal was deleted.
Impact: Microsoft 365 access plus planted privileged credentials
| Product | Affected |
|---|---|
| ConnectWise Cloud Backup | — |
- 1.Turn off affected application connections without deleting evidence.
- 2.Remove unauthorized service-principal credentials and privileged role assignments.
- 3.Enable Microsoft Graph activity logging and correlate it across tenants.
- ATT&CK
- T1078.004 Cloud AccountsT1098.001 Additional Cloud CredentialsT1098.003 Additional Cloud Roles
- Vendors
- ConnectWiseMicrosoft
- Threat actors
- Storm-0940
- Malware
- ARTEX
- Organizations
- Huntress
- Countries
- China
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 144.172.64.128 | MFA prompt. On October 15, Huntress observed activity from 144.172.64[.]128 across almost 1,000 tenants, with more than 300 successfu |
| ipv4 | 144.172.64.60 | requests/2.31 in a password spray during the same timeframe 144.172.64[.]60 Listed in the ConnectWise advisory and by Microsoft Pytho |
| ipv4 | 144.172.64.99 | ns and Graph activity (ConnectWise advisory, our telemetry) 144.172.64[.]99 Cross-tenant password spray October 10 to 14 (ConnectWise |
| ipv4 | 194.165.16.21 | r 10 to 14 (ConnectWise advisory, Microsoft, our telemetry) 194.165.16[.]21 Possible link based on re-use of python-requests/2.31 in |
From the original article
3 min read at gbhackers.com
Hackers abused compromised ConnectWise Cloud Backup application credentials to access Microsoft 365 environments, escalate privileges, and plant persistent credentials. Microsoft attributed the campaign to Storm-0940, a China-state-aligned threat actor using ARTEX, an open-source agentic AI framework, to accelerate downstream attacks against more than 2,250 tenants.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.