Storm-0940 used stolen ConnectWise credentials against 2,250 tenants
October 29: Wiz places the ConnectWise compromise among public agentic cases and cites researchers who reported personal data on about 67,000 people in related South Korean ARTEX attacks.
Microsoft says Storm-0940 used stolen ConnectWise credentials and ARTEX against more than 2,250 Microsoft 365 tenants; data theft remains unconfirmed.
Microsoft says the China state-aligned group Storm-0940 used stolen ConnectWise Cloud Backup application credentials to sign in to customers’ Microsoft 365 environments without interactive logins or ordinary user MFA. It attributes the pace—about 2,900 attempts a minute across more than 2,250 tenants—to the open-source AI framework ARTEX, with privileged access in under three hours in some cases. A password spray from October 10 to 14 failed; valid-credential activity began October 15. ConnectWise disclosed the access on October 16 and paused Cloud Backup and related services without explaining the initial takeover. Huntress confirmed widespread abuse and persistence but rates AI involvement low-to-medium from telemetry; successful sign-ins do not prove data theft. China’s Foreign Ministry denied knowledge of the incidents.
- Storm-0940 has been tracked by Microsoft since 2021 and typically steals data.
- October 10–14 spray logged over 151,000 failures against 327 accounts; none succeeded.
- October 11 peaked near 2,900 failed attempts a minute, with over 111,000 failures.
- Added application secrets can survive revocation of the original ConnectWise connection.
- Huntress saw a Teams app assign itself Global Administrator in two tenants.
- Li Puhua said on October 8 that ARTEX would go closed source after misuse.
Timeline
dated events in the reporting · oldest first- Oct 8, 2026Developer said ARTEX would go closed source · The Record
- Oct 10, 2026Failed password spraying began against eight organizations · Security Affairs
- Oct 11, 2026Failed logons peaked at about 2,900 a minute · The Record
- Oct 15, 2026Stolen credentials used against customer Microsoft 365 tenants · Security Affairs
- Oct 16, 2026ConnectWise disclosed unauthorized Cloud Backup access · Dark Reading
What each outlet adds
beyond the shared facts- The RecordClosed-source plan, ministry denial, and 111,000 October 11 failures
- Security AffairsSpray IP, 151,000 failures, and service-principal persistence
- GBHackersSecond IP, Global Administrator changes, and Huntress’s lower AI rating
- SecurityWeekSaaS Security and Cloud Management also suspended
- Wiz BlogResearchers cite about 67,000 people’s data in South Korea
Coverage
oldest first · one row per article · UTC- · 8d ago
The RecordFirst report
Microsoft ties ConnectWise backup abuse to Storm-0940 and ARTEX
Sign-in attempts hit 2,900 a minute, with more than 111,000 failures on October 11 alone.
- · 8d ago
TechCrunch · Security
Chinese hackers used stolen ConnectWise backup credentials to reach customers
Microsoft says AI agents drove nearly 3,000 sign-in attempts a minute against about 2,250 organizations.