SOCRadar page titles an October 2026 attack roundup
The captured page is site navigation and product marketing, not a write-up of the named incidents.
Stories per day · 30 days
5 RSS
Relatedmicrosoft-36528supply-chain17artex15cloud-backup15storm-094014oauth10msp9password-spraying7entra-id5skykick5credential-theft3entra3agentic-ai2application-credentials2cloud2cloud-identity2credential-abuse2credential-compromise2
50 stories, newest first · one card per story
Stories tagged #connectwise
Censys finds over 800 Artex AI hacking tools exposed online
Passwordless Artex consoles also expose implants, and prior uses include Korean finance and a ConnectWise intrusion.
Wiz says AI agents are doing hands-on intrusion work
Named cases include ARTEX and Hermes, plus three Wiz investigations that begin with an exposed Flowise service.
2
Storm-0940 targeted 2,250 Microsoft 365 tenants with stolen ConnectWise credentials
Microsoft says the ARTEX agent framework drove the campaign; Huntress rates the AI claim lower from its own telemetry.
1
Storm-0940 abused ConnectWise backup credentials in Microsoft 365
Microsoft says more than 2,250 tenants were targeted; Huntress confirmed hundreds of sign-ins but not data theft or ARTEX use.
1
Huntress post looks at a ConnectWise attack
The supplied page is site navigation, so method, victims, and whether a flaw was used are not stated.
1
Storm-0940 used AI tool Artex in ConnectWise customer intrusions
Microsoft logged more than 151,000 failed logons and successful sign-ins with ConnectWise cloud application identities.
2
Microsoft links ConnectWise breach to Storm-0940 using AI tool ARTEX
Stolen application credentials were used against 2,250 Microsoft 365 tenants, with privileged access in under three hours in some cases.
2
Microsoft ties ConnectWise backup abuse to Storm-0940 and ARTEX
Sign-in attempts hit 2,900 a minute, with more than 111,000 failures on October 11 alone.
2
Storm-0940 used agentic AI against 2,250 Microsoft 365 tenants
After a ConnectWise Cloud Backup compromise, sign-in attempts hit 2,900 a minute and some tenants saw privileged access in under three hours.
1
Storm-0940 used ConnectWise credentials against 2,250 Microsoft 365 tenants
Microsoft says the China-linked group used ARTEX and reached privileged cloud access at some organizations in under three hours.
1
Microsoft says Storm-0940 used AI to breach ConnectWise tenants
The group attempted more than 2,250 tenant sign-ins at about 2,900 per minute, often gaining access within three hours.
2
Storm-0940 used ARTEX against over 2,250 Microsoft 365 tenants
Stolen ConnectWise application credentials enabled Graph access; a separate spray of more than 151,000 logons had no successful authentication.
5
Storm-0940 used ARTEX in ConnectWise Cloud Backup supply-chain attack
Microsoft says the agents targeted more than 2,250 tenants at up to 2,900 sign-in attempts per minute.
1
Microsoft attributes ConnectWise supply-chain attack to Storm-0940
The group used ARTEX to reach more than 2,250 tenants at 2,900 sign-in attempts per minute; compromise counts are unstated.
1
Storm-0940 used ARTEX AI in ConnectWise supply-chain attacks
Microsoft says privileged cloud access sometimes took under three hours, with more than 2,250 tenants targeted.
2
ConnectWise Cloud Backup API secret used against Microsoft 365 tenants
Huntress saw malicious sign-ins across almost 1,000 Entra tenants, with more than 300 appearing to succeed.
1
ConnectWise resets Cloud Backup credentials after unauthorized access
Huntress saw vendor-credential sign-ins from 144.172.64.128, then Global Administrator grants and new secrets on two tenants.
1
ConnectWise suspends Cloud Backup after supply-chain credential attack
Huntress saw unauthorized sign-ins in 162 Microsoft 365 tenants after attackers used the backup app’s permissions.
2
.jpg%3Fwidth%3D720%26quality%3D80%26disable%3Dupscale&w=828&q=75)
ConnectWise disables Cloud Backup after Microsoft 365 logins
Researchers say ConnectWise credentials signed into customer Microsoft 365 tenants; downstream impact is unconfirmed.
1
Weekly recap: BeyondTrust zero-day, ConnectWise access, Ledger thefts
Armory Castle used CVE-2026-102764 for file operations, then planted SAWFLY and BARECLAW on a few victims.
6
ConnectWise Cloud Backup breach page lacks incident details
The supplied SOCRadar page is site navigation and does not describe what was accessed or who was affected.
1
ConnectWise suspends Cloud Backup after attackers abuse Microsoft 365 access
Huntress saw the stolen app credential sign into at least 162 Microsoft 365 tenants on October 15; earlier tokens may still work.
2
ConnectWise suspends cloud services after M365 tenant access
Huntress says a Cloud Backup client assertion reached 162 Microsoft 365 tenants on October 15–16.
2