Storm-0940 used ARTEX in ConnectWise Microsoft 365 supply-chain attack
October 23: SecurityWeek said Huntress saw compromised ConnectWise application credentials used against hundreds of Microsoft 365 tenants, including over 300 Entra tenants.
Microsoft says Storm-0940 used ARTEX to target more than 2,250 Microsoft 365 tenants after a ConnectWise Cloud Backup compromise; restoration is underway.
Microsoft says China-aligned Storm-0940 used open-source ARTEX from as early as September 2026 after compromising ConnectWise Cloud Backup, then signed in to customer Microsoft 365 tenants with already-authorized application credentials and no interactive login. It targeted more than 2,250 tenants at about 2,900 attempts per minute; some cases reached privileged cloud access in under three hours. Microsoft said its products were not flawed and a sign-in does not prove data theft. An October 10–14 spray of 327 accounts at eight organizations produced more than 151,000 failed logons and no successes, according to Security Affairs, The Hacker News, and Cyber Security News. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management and started phased restoration. Microsoft dates the company’s unauthorized-access report to October 16; Infosecurity Magazine says discovery was October 17, after suspicious activity on October 15.
- Storm-0940 has been tracked since 2021 and has no known industry aliases, Microsoft said.
- Cyber Security News: 173 tenants had confirmed unauthorized sign-ins, distinct from 2,250 targeted.
- October 11 spray peaked at 2,900 failures per minute and more than 111,000 failures.
- Added service-principal credentials can survive revocation of the original ConnectWise connection.
- Wiz says ARTEX was closed-sourced October 8 after more than 12,000 GitHub forks.
- Customers were told to keep affected ConnectWise connections disabled pending restoration guidance.
Timeline
dated events in the reporting · oldest first- Oct 8, 2026ARTEX developer closed the project source after reported misuse. · Wiz Blog
- Oct 10, 2026Password spray against 327 accounts at eight organizations began. · The Hacker News
- Oct 11, 2026Spray peaked at 2,900 failures per minute. · The Hacker News
- Oct 15, 2026Agents signed in using stolen ConnectWise application identities. · Security Affairs
- Oct 16, 2026ConnectWise reported unauthorized OAuth application access. · Microsoft Security Blog
- Oct 17, 2026ConnectWise discovered unauthorized access, Infosecurity Magazine says. · Infosecurity Magazine
What each outlet adds
beyond the shared facts- Microsoft Security BlogSays the activity was not caused by a Microsoft product flaw.
- Cyber Security NewsSeparates 173 confirmed unauthorized sign-ins from the broader targeting count.
- Wiz BlogReports Okta, Cognito, and unsigned-JWT probing plus 12,000 forks.
- The RecordNames developer Li Puhua and reports a Chinese Foreign Ministry denial.
- SecurityWeekCites Huntress on hundreds of tenants, including over 300 Entra tenants.
- Products
- ConnectWise Cloud BackupMicrosoft 365Exchange OnlineMicrosoft GraphCloud BackupGoogle WorkspaceSaaS SecurityCloud ManagementArtexEntraMicrosoft Entra IDAWS Cognito
- Threat actors
- Storm-0940
- Victims
- ConnectWise
- Organizations
- MicrosoftZscalerRecorded FutureCrowdStrikeHuntress
- Countries
- ChinaSouth KoreaJapan
- AI models
- DeepSeekGLMGrokClaude CodeCodex
Coverage
oldest first · one row per article · UTC- · 4d ago
Microsoft Security BlogFirst report
Storm-0940 used ARTEX AI in ConnectWise supply-chain attacks
Microsoft says privileged cloud access sometimes took under three hours, with more than 2,250 tenants targeted.
- · 3d ago
CyberScoop
Microsoft attributes ConnectWise supply-chain attack to Storm-0940
The group used ARTEX to reach more than 2,250 tenants at 2,900 sign-in attempts per minute; compromise counts are unstated.
- · 3d ago
The Hacker News
Storm-0940 used ARTEX in ConnectWise Cloud Backup supply-chain attack
Microsoft says the agents targeted more than 2,250 tenants at up to 2,900 sign-in attempts per minute.
- · 3d ago
Cyber Security News
Storm-0940 used ARTEX against over 2,250 Microsoft 365 tenants
Stolen ConnectWise application credentials enabled Graph access; a separate spray of more than 151,000 logons had no successful authentication.
- · 3d ago
Infosecurity Magazine
Microsoft says Storm-0940 used AI to breach ConnectWise tenants
The group attempted more than 2,250 tenant sign-ins at about 2,900 per minute, often gaining access within three hours.
- · 3d ago
CSO Online
Storm-0940 used agentic AI against 2,250 Microsoft 365 tenants
After a ConnectWise Cloud Backup compromise, sign-in attempts hit 2,900 a minute and some tenants saw privileged access in under three hours.
- · 3d ago
Wiz Blog
ARTEX-using actor expands targeting of IT and software vendors
The operator password-sprayed engineers, tested unsigned JWTs, and probed cross-tenant access on Okta, Entra ID and Cognito.
- · 3d ago
The Record
Microsoft ties ConnectWise backup abuse to Storm-0940 and ARTEX
Sign-in attempts hit 2,900 a minute, with more than 111,000 failures on October 11 alone.
- · 2d ago
Security Affairs
Microsoft links ConnectWise breach to Storm-0940 using AI tool ARTEX
Stolen application credentials were used against 2,250 Microsoft 365 tenants, with privileged access in under three hours in some cases.
- · 2d ago
SecurityWeek
Storm-0940 used AI tool Artex in ConnectWise customer intrusions
Microsoft logged more than 151,000 failed logons and successful sign-ins with ConnectWise cloud application identities.