Storm-0940 used stolen ConnectWise credentials against Microsoft 365 tenants
First merged summary.
Microsoft says Storm-0940 used stolen ConnectWise credentials and ARTEX against more than 2,250 Microsoft 365 tenants; theft is unconfirmed.
Microsoft says China-state-aligned Storm-0940 used stolen ConnectWise application credentials and its ARTEX agent framework to attempt access to more than 2,250 Microsoft 365 tenants. The activity used permissions customers had already granted, not a newly disclosed Microsoft vulnerability, and application sign-ins bypassed ordinary user MFA prompts. Cyber Security News reports Huntress saw most activity on October 15 in under 14 hours, including a sweep of nearly 1,000 tenants, secret changes, and a Teams identity assigning itself Global Administrator. A separate password-spray phase logged more than 151,000 failed logons against 327 accounts. Microsoft says targeting is not confirmed data theft; missing Graph activity logs leave successful reads unproven. Cyber Security News says Huntress rates the AI-driver claim lower than Microsoft does.
- Microsoft calls Storm-0940 a China-state-aligned group using stolen ConnectWise credentials.
- Attempts reached more than 2,250 Microsoft 365 tenants via already granted permissions.
- Earlier reporting documented unauthorized sign-ins across 173 partner and customer tenants.
- One October 15 sweep processed almost 1,000 tenants in ascending identifier order.
- Password spray logged more than 151,000 failed logons against 327 accounts.
- Missing Graph activity logs leave successful reads and data theft unproven.
Timeline
dated events in the reporting · oldest first- Oct 15, 2026Most observed tenant activity occurred within 14 hours · Cyber Security News
What each outlet adds
beyond the shared facts- Cyber Security NewsMicrosoft attribution, ARTEX claim, Huntress telemetry, and the AI-role disagreement
- Vendors
- MicrosoftConnectWise
- Products
- Microsoft 365
- Threat actors
- Storm-0940
- Malware
- ARTEX
- Organizations
- Huntress
- Countries
- China
Coverage
oldest first · one row per article · UTC- · 4d ago
HuntressFirst report
Huntress post looks at a ConnectWise attack
The supplied page is site navigation, so method, victims, and whether a flaw was used are not stated.
- · 3d ago
Cyber Security News
Storm-0940 targeted 2,250 Microsoft 365 tenants with stolen ConnectWise credentials
Microsoft says the ARTEX agent framework drove the campaign; Huntress rates the AI claim lower from its own telemetry.