Microsoft attributes ConnectWise cloud compromise to Storm-0940

Microsoft has attributed the supply chain compromise of the ConnectWise Cloud Backup application to Storm-0940, a China state-aligned threat actor. The group used ARTEX, a Go-based agentic AI penetration-testing framework, to accelerate follow-on activity against downstream victims, including scanning, reconnaissance, password spraying and OAuth application abuse.

Microsoft said the campaign has targeted hundreds of organisations worldwide across numerous sectors since September 2026. In the ConnectWise activity, the actor attempted sign-ins to more than 2,250 tenants at a peak rate of 2,900 attempts per minute, sharply reducing the time available for defenders to identify and contain suspicious identity activity.

Compromised application trust became the route to customers

Between October 10 and 14, infrastructure at 144.172.64[.]99 ran an automated cross-tenant password-spray campaign against 327 accounts at eight organisations, seeking access to Microsoft 365 and Exchange Online. Microsoft recorded more than 151,000 failed logons in that period. The activity peaked on October 11, with more than 111,000 failures in one day; 48 accounts each received more than 1,000 failures.

Microsoft found no successful authentication, token issuance, Graph call or directory change during that password-spray window. On October 15, however, the AI agents gained access to identities belonging to multiple ConnectWise cloud applications. They then used stolen application credentials and the trust already granted to those applications to authenticate to customer environments.

In some cases, the activity extended beyond authentication to Microsoft Graph and directory operations. Microsoft observed reconnaissance, changes to application credentials intended to establish persistence, and modifications involving identities, groups and privileged roles. The company warned that altered application credentials can maintain a backdoor through other identities, credentials and cloud services even after the originally compromised application has been remediated.

AI agents compress the defensive response window

ARTEX had been made closed-source after its abuse against South Korean financial institutions, but Microsoft said actors in multiple regions have weaponised the framework. In this campaign, the tool allowed Storm-0940 to conduct work at machine speed and pursue several attack paths without an interactive user sign-in when a trusted application already had access.

Storm-0940 has been active since at least 2021. Microsoft first described the group in November 2024 in connection with the Quad7, also known as CovertNetwork-1658, botnet and evasive password-spray operations. The actor has also exploited internet-facing applications for initial access and added credentials to existing OAuth applications to retain access to Microsoft 365 resources.

Microsoft said some ARTEX-driven incidents reached privileged cloud access in less than three hours from initial targeting. ConnectWise temporarily shut down services after the attacks and is restoring them in phases, a process it expects to take several days.

What organisations should take from the incident

ConnectWise said the campaign reaches beyond a single company because trusted software connections can open paths to many organisations, particularly through managed service providers. The practical implication is that businesses should treat application identities and vendor-granted OAuth trust as critical access paths: monitor high-volume sign-in failures, investigate application credential changes and privilege modifications, and prepare to revoke or contain trusted application access when a supplier compromise is suspected.