Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhigh

Microsoft links Storm-0940 to ConnectWise cloud credential attacks

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Microsoft says Storm-0940 used stolen ConnectWise cloud credentials and ARTEX to target more than 2,250 Microsoft 365 tenants.

Microsoft says China-linked Storm-0940 used stolen ConnectWise Cloud Backup application credentials and the AI penetration-testing tool ARTEX against more than 2,250 Microsoft 365 tenants. A password spray from October 10–14 failed; from October 15 the group signed in without interactive logins and, in some cases, changed application credentials and directory roles within three hours. Microsoft says most targeting failed, though privileged persistence was achieved at many organizations and can survive revocation of the original connection. ConnectWise disclosed the access on October 16 and suspended Cloud Backup, SaaS Security, and Cloud Management without explaining the takeover. Security Affairs counts more than 151,000 failed logins against 327 accounts; SecurityWeek says over 300 accounts.

Key facts
  • Failed spray from 144.172.64.99 peaked at 2,900 attempts per minute on October 11.
  • Valid credentials then drove 2,900 sign-in attempts per minute across 2,250 tenants.
  • Added service-principal credentials can persist after the original ConnectWise connection is revoked.
  • Broader activity dates to early September across aerospace, defense, energy, finance, and manufacturing.
  • Huntress reported hundreds of Microsoft 365 tenants, including over 300 Entra tenants.
  • According to Security Affairs, Zscaler and Recorded Future saw ARTEX used against South Korean financial institutions.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 10, 2026Password spraying against eight organizations began. · Security Affairs
  2. Oct 11, 2026Failed logins peaked at 2,900 attempts per minute. · Security Affairs
  3. Oct 15, 2026Stolen ConnectWise credentials used for tenant sign-ins. · Security Affairs
  4. Oct 16, 2026ConnectWise disclosed unauthorized access and containment guidance. · Dark Reading

What each outlet adds

beyond the shared facts
  • Dark ReadingPrivileged access in under three hours; no public explanation of the takeover.
  • Security AffairsSpray IP, 327 accounts, persistence detail, and South Korea ARTEX sightings.
  • SecurityWeekActor active since 2021; product suspensions; Huntress count of Entra tenants.
Vendors
MicrosoftConnectWise
Products
Microsoft 365ConnectWise Cloud BackupArtexMicrosoft GraphEntra
Threat actors
Storm-0940
Malware
ARTEX
Organizations
ZscalerRecorded FutureHuntressCrowdStrike
Countries
ChinaSouth Korea
AI models
DeepSeekGLMGrok

Coverage

oldest first · one row per article · UTC
  1. · 8d ago Dark ReadingFirst report

    Microsoft links Storm-0940 to ConnectWise Cloud Backup attack

    Compromised Cloud Backup application credentials were used to target more than 2,250 Microsoft 365 tenants.

  2. · 8d ago Security Affairs

    Microsoft links ConnectWise breach to Storm-0940 using AI tool ARTEX

    Stolen application credentials were used against 2,250 Microsoft 365 tenants, with privileged access in under three hours in some cases.