Storm-0940 ARTEX: what the ConnectWise breach was

What’s new, in 20 seconds

On October 21, 2026, Microsoft attributed the ConnectWise Cloud Backup supply-chain compromise to Storm-0940, a China state-aligned group active since 2021. It says the group used ARTEX, an AI penetration-testing framework, to speed up scanning, password spraying and abuse of ConnectWise's Microsoft 365 apps.
Microsoft's 2,250 figure is tenants where Storm-0940 attempted sign-ins, not confirmed breaches. Microsoft says most of the targeting failed and gives no count of compromised organizations. Huntress confirmed unauthorized sign-ins in 162 tenants by October 16, and on October 17 said more than 300 tenants showed successful sign-ins from the attacker's IP address.
ARTEX was built by a developer using the GitHub handle Autumn-27, who said on October 8 it would go closed-source after its use against South Korean banks. Microsoft says actors in several regions use it; no source links the Korean attacks to Storm-0940.

Contents

On October 21, 2026, Microsoft said Storm-0940, a China state-aligned hacking group, was behind the compromise of ConnectWise Cloud Backup, a Microsoft 365 backup service used by managed service providers, in a supply-chain attack that security firms had been tracking since October 15. Microsoft says the group used ARTEX, an AI agent framework for penetration testing, to "attempt to sign-in to more than 2,250 tenants." Some headlines turned that into 2,250 breached tenants. Microsoft's post doesn't say that, and it gives no count of organizations actually compromised.

This story is based on Microsoft Threat Intelligence's October 21 report (last modified October 23), ConnectWise's Trust Center advisory, Huntress's investigation and updates through October 19, CrowdStrike's, Recorded Future's and Zscaler's ARTEX research, and reporting by Reuters, BleepingComputer, The Record and Infosecurity Magazine, checked October 23, 2026. Attackers renting AI to run their scans isn't new; our story on MONST3R-AI and stolen API keys covered a criminal version in October.

The short version

Who: Storm-0940, which Microsoft calls China state-aligned, active since 2021 and focused on data theft. On October 21, ConnectWise said that, based on evidence including Microsoft's threat intelligence, "it appears that a China state-aligned group was responsible."
What: attackers took over ConnectWise's own Microsoft 365 application identities and used the access customers had granted them.
ARTEX's role: per Microsoft, it sped up scanning, password spraying and OAuth app abuse. Microsoft says ARTEX "can use any AI model."
The 2,250 figure: tenants with attempted sign-ins, not confirmed breaches.
Confirmed impact: Huntress confirmed unauthorized sign-ins in 162 of its customers' tenants by October 16; Microsoft says Storm-0940 "achieved privileged cloud persistence at many organizations."

What happened at ConnectWise?

According to Huntress, a ConnectWise Cloud Backup credential, a client assertion held in ConnectWise's own tenant, was used to sign in to customers' Microsoft 365 environments as the backup app. Because the sign-ins came from a script acting as an application, not a user, multi-factor authentication didn't apply, BleepingComputer reported, citing the security firm Todyl.

ConnectWise Cloud Backup compromise, October 2026

2026-10-10Password spray from Storm-0940 infrastructure begins; 327 accounts at eight organizations targeted through October 14Confirmed
2026-10-13Huntress sees password spraying against four law firms from the IP later tied to the ConnectWise appsConfirmed
2026-10-15ConnectWise app identities assign themselves directory roles in about 50 Huntress-monitored tenantsConfirmed
2026-10-16Huntress confirms unauthorized sign-ins in 162 tenantsConfirmed
2026-10-17ConnectWise disables seven application identities and takes Cloud Backup offlineConfirmed
2026-10-21Microsoft attributes the compromise to Storm-0940 and ARTEXConfirmed

Figure 1Four days passed between the first spraying Huntress saw, on October 13, and ConnectWise disabling its app identities on October 17. Source: Microsoft Threat Intelligence; Huntress; ConnectWise Trust Center, as of October 23, 2026.

Huntress's timeline: password spraying against four law firms on October 13 and 14, which failed; then, from 01:58 UTC on October 15, ConnectWise Cloud Management apps assigning themselves directory roles, mostly Exchange Administrator, in about 50 tenants it monitors. In one tenant, the Cloud Management MS Teams app made itself Global Administrator and added secrets to two other apps, including Huntress's own. In an October 17 update, Huntress said about 1,000 Entra tenants showed sign-in activity from the attacker's IP address, more than 300 of them successful. By October 19 it had found the same Global Administrator pattern in a second tenant, with no mailbox, file, user or policy changes in the two tenants it reviewed.

ConnectWise's advisory, first published October 16, said it had found "unauthorized access to application identities within the ConnectWise Cloud Backup environment" and had "no indicators to date that Cloud Backup partner backup data has been compromised." It disabled seven application identities at 07:00 UTC on October 17 and took Cloud Backup, SaaS Security and Cloud Management offline. On October 19 it told Infosecurity Magazine it couldn't discuss attribution; on October 21 its advisory said a China state-aligned group appeared responsible.

ConnectWise began restoring services in phases on October 21. Its October 23 update says it expects to finish testing and security validation of the restored environment by the end of that weekend, to let partners restore data from existing backups early the following week, and then to start phased re-enrollment. It says existing backup archives "remain encrypted, isolated and preserved, with no indication of compromise," but that restoring its service doesn't remove access an attacker may already have set up inside a customer's tenant. How the attackers obtained the credential hasn't been disclosed.

What does "2,250 Microsoft 365 tenants" mean?

It's a count of attempts. Microsoft's report says that after the unauthorized access, Storm-0940 "used ARTEX to attempt to sign-in to more than 2,250 tenants." It says the group's ARTEX-driven attacks since September targeted hundreds of organizations and that "the majority of the targeting wasn't successful."

Separately, Microsoft describes a cross-tenant password spray from October 10 to 14 against 327 accounts at eight organizations: more than 151,000 failed logons, peaking at 2,900 failures a minute on October 11 and more than 111,000 in one day. For that spray, Microsoft says "no successful authentication, token issuance, Graph call, or directory change was observed."

Microsoft does say that in "multiple instances" the attackers reached privileged access in under three hours, and that in some environments they moved on to Microsoft Graph and directory changes, including adding app credentials for persistence and changing roles, and that the group has used such apps "to access and exfiltrate email and other data through Microsoft Graph." It also says an affected app or a successful sign-in "does not necessarily indicate that customer data was accessed or exfiltrated," and that the activity didn't come from a compromise of, or vulnerability in, Microsoft's own systems.

Microsoft's 2,250 attempted tenants and Huntress's 162 and 300-plus confirmed sign-ins come from different vantage points and shouldn't be combined into one total.

What is ARTEX, and who named it?

ARTEX is the tool's own name. CrowdStrike, in an October 7 report, called it "a recently released open-source agentic penetration testing (pentesting) tool developed in China." Microsoft describes a multi-agent system written in Go that runs a test "from reconnaissance through data exfiltration" with little human input.

Its developer, who uses the GitHub handle Autumn-27, said on October 8 that "the ARTEX project will no longer be updated and will be converted to closed source," after it was used in attacks on South Korean banks, Reuters reported. Microsoft's October 21 report still calls it open source; copies released before the change remain in circulation, so both descriptions can hold.

The Korean attacks aren't tied to Storm-0940. CrowdStrike assessed with moderate confidence that that operator was a Chinese speaker and "financially motivated," and Recorded Future tracks it as TAG-217. Zscaler described a Chinese-speaking operator using a customized ARTEX alongside Claude Code, Codex and Grok. None of those reports mentions Storm-0940 or ConnectWise. Microsoft says it has seen "threat actors across multiple geographic regions" using ARTEX.

What should Microsoft 365 admins check?

Microsoft and Huntress give overlapping guidance:

Keep affected ConnectWise apps disabled until ConnectWise gives restoration instructions. Disable, don't delete, so evidence and consent records survive.
Find the apps by application ID, not display name, in every tenant. The Cloud Backup app ID is 506e08f9-6e9a-4da4-942b-a099a03644ae.
Preserve Entra sign-in and audit logs, then review activity from at least October 15, back to October 1 where possible.
Look for credentials, owners, role assignments and consent grants added since October 13 that you didn't make, especially Global Administrator.
Don't treat a clean search for the published IP addresses as proof of no access. Microsoft's report lists them along with hunting queries.

The broader lesson is the one in our LiteLLM compromise story: a trusted vendor credential is a path into every customer that trusts it. AI-found and AI-exploited flaws are also why OpenAI proposed a staged disclosure process, covered in our Patch the Planet story.

What's confirmed, reported and uncertain

Confirmed (Microsoft): the Storm-0940 attribution, ARTEX's use, the 2,250 attempted tenants and the password-spray figures, and its guidance.
Confirmed (Huntress): its timeline and the 162 and 300-plus sign-in counts.
Confirmed (ConnectWise): its containment steps, the seven disabled identities, its attribution statement and its restoration plan, from its Trust Center advisory.
Reported: the developer's closed-source statement (Reuters).
Uncertain: how many organizations were compromised or lost data; how the credential was stolen; when service is fully restored (ConnectWise's dates are anticipated, not confirmed). Microsoft gives no confidence level for its attribution.