Storm-0940 and ARTEX: Microsoft ties a China-aligned group to the ConnectWise attack

On 21 October 2026 Microsoft attributed the attack on ConnectWise Cloud Backup to Storm-0940, a group aligned with the Chinese state. In its analysis, the company says the group used ARTEX, an open-source penetration testing framework driven by AI agents, to attempt sign-ins to more than 2,250 Microsoft 365 tenants. In several cases it went from first targeting to privileged access in under three hours.

This is the missing piece in the incident we analysed on 19 October, when nobody had yet attributed the attack. The attribution identifies the actor and the tool, and the way in remains the same. The attacker gained control of a supplier's application identities, which its customers had authorised with broad permissions, and AI, according to Microsoft, sped up both the earlier password spray and the later abuse of those identities.

What has Microsoft attributed to Storm-0940?

Microsoft "assesses that Storm-0940 was responsible" for the ConnectWise supply chain compromise, without stating a confidence level. According to The Record, the link rests partly on IP addresses published by ConnectWise, which matched those in Microsoft's own investigation.

Storm-0940 is an APT group active since 2021, with no known industry aliases. Microsoft describes an actor that gets in through password spraying and internet-facing applications, then stays by adding credentials to existing OAuth applications so it can read mail and data through Microsoft Graph. In an October 2024 profile, Microsoft placed its targets in North America and Europe, among think tanks, government bodies, NGOs, law firms and the defence industrial base.

The 2026 campaign targets aerospace and defence, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks and non-profits. Microsoft does not name countries. ConnectWise chief executive Manny Rivelo said in a statement reported by Reuters that "it appears that a China state-aligned group was responsible". The Chinese embassy replied that China opposes hacking and "smears and attacks against China under the excuse of cybersecurity issues".

How did the attack unfold?

Microsoft dates Storm-0940's use of ARTEX to as early as September 2026. Between 10 and 14 October, from the address 144.172.64[.]99, the group ran a password spray against 327 accounts at eight organisations, with more than 151,000 failed attempts and a peak of 2,900 failures per minute on the 11th. Microsoft saw no successful sign-in from that phase.

On 15 October the attacker moved on to the identities of several ConnectWise applications, from the same address range. Sophos describes a sweep of about 96 minutes from a single server, which went through tenants in ascending identifier order and included former customers of the backup service. Microsoft counts more than 2,250 tenants with sign-in attempts and, in its infographic, over 200 sign-ins in under four minutes using four application credentials.

Some tenants saw reconnaissance through Graph, changes to application credentials to keep access, and changes to identities, groups and privileged roles, including a ConnectWise management application assigning itself the Global Administrator role. Microsoft warns that those changes "can remain active as a backdoor". In Azure, according to Microsoft's detection table, the attacker enumerated resources and read secrets at scale across several Azure Key Vaults.

ConnectWise disabled the seven application identities on 17 October, completed a reset of all accounts and credentials on the 19th and, according to its status page, has been restoring services in phases since the 21st. The company has still not explained how the attacker obtained control of those identities.

How should each circulating figure be read?

The published figures measure different things, and some headlines have turned attempts into breached companies. The table sets out what each one means according to its source.

Microsoft says most of the targeting failed but that the group achieved privileged cloud persistence at "many organizations", without giving a number. It also notes that even a successful authentication "does not necessarily indicate unauthorized data access".

What is ARTEX and what part did AI play?

ARTEX is a multi-agent penetration testing framework with a Go core, which supports different AI models and chains together reconnaissance, exploitation and exfiltration. According to Wiz, it appeared on GitHub in July 2026 and had more than 12,000 forks when its author closed it. On 8 October, before the attribution, the developer announced that the project would stop receiving updates and become closed source because of misuse, although several AGPL-licensed forks remain active on GitHub.

Storm-0940 is not the only actor to have used it. Zscaler and Recorded Future documented campaigns this month by likely Chinese-speaking, financially motivated actors against South Korean financial firms. In a later analysis of a wider campaign, Zscaler found ARTEX configured to use a DeepSeek model through an OpenAI-compatible gateway, while noting that this does not confirm which model answered. Microsoft says it has seen actors in several regions using the tool.

That AI was used in the ConnectWise phase is a Microsoft claim, not backed by published artefacts, and the only public indications are the speed and scale of the activity. The user agents observed (Python-urllib/3.12, python-requests/2.31.0, curl/7.88.1) are generic. Huntress's Jon Semon told Cybersecurity Dive that its "working hypothesis" is that an AI agent using scripted tooling, with occasional human intervention, carried out the attacks.

Sophos, which does not mention AI, describes a script working through a list of tenants. According to SC World, Anthony Pillitiere, co-founder of Horizon3, argues that what got the attacker in was a poorly protected vendor secret with access to thousands of tenants. That reading fits the pattern we described when covering autonomous AI agents running DeepSeek models, in which AI shortens the time between a stolen credential and control of an environment and lets the operation run against thousands of tenants at once.

Where does the case stand compared with 19 October?

The attribution adds the actor, the tool and ARTEX use from as early as September. Microsoft also publishes three VPN addresses (187.15.88[.]186, 187.15.90[.]217 and 187.15.89[.]186) and the user agent azure-toolkit/1.0, and describes the bulk reading of secrets in Azure, which did not appear in our 19 October analysis. The addresses in the 144.172.64.x range match those published by Huntress and ConnectWise.

The most important practical change concerns Azure Key Vault. If the ConnectWise application had access to secret stores, the keys, certificates and connection strings held there should be treated as exposed, even when the tenant shows no other changes.

What should organisations with ConnectWise applications review?

Microsoft publishes a list of mitigations and hunting queries for Defender XDR and Microsoft Sentinel. Preserving evidence comes first. The list below summarises them and adds one recommendation of our own on secret stores.

• ConnectWise connections should stay disabled until the vendor sends restoration guidance, and enterprise applications should not be deleted before evidence has been preserved.
• The inventory should be built by application ID, not display name, with the object ID of each service principal in each tenant.
• Entra ID sign-in and audit logs, Purview, the SIEM and Graph logs should be preserved before they expire. The review should cover at least the period from 15 October, and from 1 October for service principal sign-ins.
• The audit covers added credentials, new applications and owners, app role assignments and consent grants, privileged roles, Conditional Access changes, mail and file access, forwarding and transport rules and delegated permissions.
• On suspicious activity, Microsoft asks for unnecessary permissions to be revoked and credentials rotated. In our view that includes secrets in the vaults the application could reach, and bulk secret reads can be hunted for in the CloudKeyVaultEvents table.
• The vendor's remediation and the tenant's remediation should be checked separately, because disabling the application does not undo changes made inside the environment.

Defender detections include names such as "Application self-assigned Global Administrator role" and "Suspicious addition of application role assignments by service principal to itself". Microsoft's queries combine EntraIdSpnSignInEvents and GraphAPIAuditEvents from 13 October, and the company warns that an empty result does not prove there was no access. A Microsoft 365 security review or an incident response service can take on that investigation if the internal team lacks capacity.

On the free edition of Entra ID, sign-in and audit logs are kept for seven days, against 30 days on P1 and P2 licences, and that retention can decide the outcome. For an organisation subject to the GDPR or NIS2, the 72-hour notification deadline and, for a significant incident, the 24-hour early warning can start running before the logs can answer what happened.

How does this affect defence against AI-agent attacks?

When the step from a stolen credential to privileged access is measured in hours, controls that depend on a manual review the next day arrive too late. Protecting non-human identities becomes the front line, because an application granted consent in thousands of tenants never passes through multi-factor authentication or user Conditional Access.

Shane Barney, CISO at Keeper Security, told SC World that "autonomous agents thrive in environments where non-human identities are loosely governed". The measures in our guide to non-human identities and API keys (consent inventory, least privilege, limits on long-lived secrets) apply here unchanged, as part of a non-human identity security programme.

Defender alerts on role self-assignment and hunting for bulk secret reads only help if someone, or an automated rule, acts within minutes. That is the job of a managed SOC able to contain incidents out of hours, and threat intelligence makes it possible to load the indicators from Microsoft, Huntress and Wiz on the day they are published.

For third-party risk management, the case confirms that a supplier with a multi-tenant application is a potential supply chain attack. ConnectWise made a similar point in its 21 October update, reported by Infosecurity Magazine, when it described MSPs as "targets in their own right" and also "a path into every client they serve".

Which questions remain open?

As of 24 October 2026, neither ConnectWise nor Microsoft has explained how the attacker obtained control of the application identities. Microsoft has not published how many organisations suffered persistent changes or whether data was stolen, and it has shown no artefacts linking ARTEX to the ConnectWise phase beyond the tempo of the activity.

Nor is there a specific advisory from CISA, the UK NCSC, CCN-CERT, INCIBE or ENISA. No victims in Spain have been named. None of the sources we reviewed links Storm-0940 to the financially motivated groups that used ARTEX against South Korean banks.

A supplier with consented access to thousands of environments lost control of its application identities, and a state actor used that window with tools that, according to Microsoft, let it reach privileged access in under three hours in several cases.

Sources and attribution: this analysis draws on the Microsoft Threat Intelligence report of 21 October 2026, the ConnectWise status page and analyses by Huntress, Sophos, Wiz, Zscaler and Recorded Future. It also uses coverage by Reuters, The Record, Cybersecurity Dive, Infosecurity Magazine and SC World, with the information available on 24 October 2026. The attribution to Storm-0940 and the use of AI are Microsoft's claims. Mentioning ConnectWise does not imply failings beyond those the company itself has disclosed.

Notice: the mitigations and queries cited are for guidance and must be adapted to each environment and tested before use in production. The full queries and updated indicators are in the Microsoft report.