Microsoft ties ConnectWise breach to Storm-0940 and an AI attack framework

Microsoft ties ConnectWise breach to Storm-0940 and an AI attack framework

21 October 2026: Microsoft says a China-state-aligned group it tracks as Storm-0940 was behind the compromise of ConnectWise's cloud backup application identities, and that the group ran its campaign with ARTEX, an open-source framework in which AI agents carry out a penetration test from reconnaissance to data theft with little human input. In several attacks the group went from first targeting to privileged cloud access in less than three hours.

Not yet independently verified. The attribution is Microsoft's assessment; ConnectWise has not named the attacker, and Microsoft says an affected app or a sign-in does not by itself prove data was taken. We will update this when it can be confirmed, and remove this note.

What ARTEX did at scale

ARTEX is a multi-agent system written in Go with a web front end that can run on any AI model, and Microsoft says it has seen several actors in different regions use it. Storm-0940, active since 2021, used it from as early as September against hundreds of organisations. Between 10 and 14 October a password spray from the 144.172.64.x range hit 327 accounts at eight organisations with more than 151,000 failed logons, peaking at 2,900 failures a minute on 11 October; none of those succeeded. After ConnectWise's first advisory on 16 October, the group used the stolen application identities to try signing in to more than 2,250 tenants at 2,900 attempts a minute.

Why application identities were the prize

The ConnectWise apps had been granted access to customers' Microsoft 365 tenants, so whoever held their credentials could authenticate as the app, without any user signing in. In some environments the agents then used Microsoft Graph for reconnaissance, added credentials to applications, which can outlast removal of the original app, changed identities, groups and privileged roles, and in one case a ConnectWise management application assigned itself the Global Administrator role. Microsoft stresses the activity did not come from any flaw in its own systems, and that an affected app or a successful sign-in does not by itself prove that data was accessed.

The checks Microsoft asks tenants to run

• keep the affected ConnectWise connections disabled until ConnectWise publishes restoration steps, and do not delete the enterprise apps first, so the evidence survives
• find the four ConnectWise application IDs in every tenant where they are or were authorised, searching by ID rather than display name
• review service-principal sign-ins from at least 15 October, back to 1 October where logs exist, successful and failed separately
• audit Entra for added credentials, new owners, consent grants, app-role and privileged role assignments, and changes to users, groups, authentication methods and Conditional Access
• check mailboxes and files for unusual downloads, forwarding and inbox rules, then remove what is confirmed unauthorised and rotate credentials

Beyond this incident, Microsoft's advice is to give multi-tenant applications only the permissions they need and to watch for app-only activity and credential additions on high-privilege apps. Managed service providers and backup vendors hold exactly that kind of access across many customers, which is what made a single vendor's identities worth attacking.

Related on TrustList:

• SafePay ransomware has hit 600 victims, says joint FBI and CISA advisory
• Vela LatAm to buy Brazilian managed IT provider Penso, pending CADE

Sources

• Microsoft Security Blog: Storm-0940 uses ARTEX agentic AI in ConnectWise supply chain compromise, 21 October 2026