Microsoft Links Storm-0940 to ConnectWise Cloud Backup Supply-Chain Compromise Using ARTEX
Summary
Microsoft linked China-aligned Storm-0940 to a ConnectWise Cloud Backup supply-chain compromise, saying ARTEX AI agents accelerated attacks against customer environments. Some activity reached privileged cloud access; ConnectWise is restoring services in phases.
Key points
- Microsoft attributed the ConnectWise Cloud Backup supply-chain compromise to China state-aligned actor Storm-0940.
- Microsoft said Storm-0940 used ARTEX, an AI-enabled penetration-testing framework, for scanning, reconnaissance, password spraying, and OAuth application abuse.
- Between October 10 and 14, 2026, Microsoft observed password spraying against 327 accounts across eight organizations; it reported no successful authentication during that phase.
- On October 15, Microsoft said the attackers gained control of identities for multiple ConnectWise cloud applications and used their credentials to authenticate to customer environments.
- In some cases, activity progressed to Microsoft Graph and directory operations, including reconnaissance, credential changes, and changes involving identities, groups, and privileged roles.
- Microsoft reported that some ARTEX-driven attacks achieved privileged cloud access in under three hours. ConnectWise temporarily shut down services and is restoring them in phases.
Article Details
- Victim Organization
- ConnectWise and downstream customer organizations
- Incident Type
- Supply-chain compromise involving ConnectWise Cloud Backup application identities, followed by attempted and, in some cases, successful authentication to customer cloud environments
- Incident Date
- 2026-10-15
- Operational Impact
- ConnectWise temporarily shut down services and restored them in phases; restoration was expected to take several days. Microsoft reported that some activity progressed to privileged access and directory operations in targeted environments.
- Ransom Or Extortion
- Prompts in analyzed ARTEX histories asked about selling stolen data, suggesting possible financial motivation; the article does not confirm data theft or extortion in this incident.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 144[.]172[.]64[.]99 | Microsoft identified this Storm-0940 infrastructure as conducting the automated cross-tenant password-spray campaign. |
People
Threat Actors
Quad7Botnet reportedly leveraged by Storm-0940 for evasive password-spray attacks.Storm-0940Microsoft attributed the ConnectWise-related activity to this China state-aligned actor.TAG-217Recorded Future Insikt Group's moniker for the threat cluster behind attacks on South Korean financial institutions; the article links activity to the same broader ARTEX-related reporting.
Vendors
Products
Androidusing the YiiMP platform, as well as set up a workspace for testing weaknesses in iPhones and modifying Android system software.ConnectWise Cloud BackupMicrosoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application.Exchange Onlinecampaign targeting 327 accounts across eight organizations to gain access to Microsoft 365 and Exchange Online," Microsoft said.iPhonesmining operations using the YiiMP platform, as well as set up a workspace for testing weaknesses in iPhones and modifying Android system software.Microsoft 365 Apps for Enterpriseby adding credentials to existing OAuth applications within cloud infrastructures to ensure access to Microsoft 365 resources.Microsoft GraphIn some of these cases, the AI agents are assessed to have progressed beyond authentication to Microsoft Graph and directory operations. This included reconnaissance, application credential modifications to establishYiiMPthreat actor is said to have put together tools to attack cryptocurrency mining operations using the YiiMP platform, as well as set up a workspace for testing weaknesses in iPhones and modifying Android system
Tools
ARTEXDuring the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse in cyber attacks targeting South Korean financial institutions, toClaude Codethat included AI assistant configurations, synchronization scripts, network routing tools, and a Claude Code prompt history.DeepSeek"ARTEX was configured to use a DeepSeek model through an OpenAI-compatible gateway, but other configurations also specified DeepSeek, GLM, and Grok," security researcher Seongsu Park said. "Prompts directed AI models toGLMa DeepSeek model through an OpenAI-compatible gateway, but other configurations also specified DeepSeek, GLM, and Grok," security researcher Seongsu Park said. "Prompts directed AI models to divide investigationGrokmodel through an OpenAI-compatible gateway, but other configurations also specified DeepSeek, GLM, and Grok," security researcher Seongsu Park said. "Prompts directed AI models to divide investigation tasks and
Countries
ChinaMicrosoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application.South KoreaZscaler ThreatLabz has since revealed that the attack's footprint extends beyond South Korea, and that it opportunistically targeted organizations around the globe and across multiple industry sectors. The findings come
Industries
Aerospace and defenseacross the world spanning a broad range of sectors since September 2026. Targets include aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media,Automotiveworld spanning a broad range of sectors since September 2026. Targets include aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military,Chemicalsa broad range of sectors since September 2026. Targets include aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software,Energyrange of sectors since September 2026. Targets include aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software,Financial Servicessectors since September 2026. Targets include aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and thinkGovernment2026. Targets include aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks andLegalTargets include aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits.Manufacturinginclude aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits.Mediaand defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits.Militaryand defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits.semiconductorautomotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits.Softwarechemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits.Technologyenergy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits.Think tanks and non-profitsgovernment, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits.