Microsoft Says Storm-0940 Used ARTEX in ConnectWise Supply-Chain Compromise

Oct 21, 2026 · Original article ↗

Summary

Microsoft says China-aligned Storm-0940 used ARTEX to automate attacks targeting hundreds of organizations and assesses the actor was responsible for the ConnectWise multi-tenant application compromise. Some attacks reached privileged cloud access in under three hours.

Key points

Microsoft says Storm-0940 used ARTEX from September 2026 to automate reconnaissance, password spraying, and OAuth application abuse against hundreds of organizations.
Microsoft assesses Storm-0940 was responsible for the ConnectWise multi-tenant application compromise and says the actor used compromised application credentials to access customer environments.
After the compromise, Microsoft observed suspicious Microsoft Graph reconnaissance, application credential changes, and attempts to modify privileges in multiple customer environments.
Between October 10 and 14, infrastructure linked by Microsoft to Storm-0940 generated more than 151,000 failed logons against 327 accounts at eight organizations; no successful authentication or Graph activity was observed in that campaign.
Microsoft says some ARTEX-driven attacks obtained privileged cloud access in under three hours, but the presence of an affected application or successful authentication does not by itself establish that customer data was accessed or exfiltrated.
Microsoft advises customers to review service-principal sign-ins, application credentials and privileges, and related Microsoft Graph activity; preserve evidence and follow ConnectWise’s containment guidance.

Article Details

Attack Vectors: Storm-0940 used ARTEX to automate scanning and reconnaissance, password spraying, and OAuth application abuse.
The actor used compromised ConnectWise multi-tenant application credentials to authenticate to downstream Microsoft 365 customer environments without interactive user sign-ins.
Follow-on activity included Microsoft Graph reconnaissance, application credential changes, and attempts to modify privileges and identities.
Defensive Notes: Keep affected ConnectWise application connections disabled until ConnectWise provides formal restoration instructions.
Preserve configuration and evidence before removing applications or credentials, and review tenants where affected applications are or were installed.
Review service-principal sign-ins and Microsoft Entra audit records for credential additions, new applications or owners, consent grants, role assignments, and changes to users or groups.
Correlate suspicious authentication with Microsoft Graph activity and unusual mail or file access; successful authentication alone does not establish data access or exfiltration.
Follow ConnectWise containment and restoration guidance, apply least privilege to multi-tenant application permissions, and rotate credentials when suspicious activity is confirmed.

Indicators of compromise

Type	Indicator	Context
IPV4	`144[.]172[.]64[.]128`	Listed as an IP observed performing sign-ins and Graph API activity in customer environments through ConnectWise applications.
IPV4	`144[.]172[.]64[.]60`	Listed as an IP observed performing sign-ins and Graph API activity in customer environments through ConnectWise applications.
IPV4	`144[.]172[.]64[.]99`	Storm-0940 infrastructure used for an automated cross-tenant password-spray campaign; the same IP was later associated with activity involving compromised ConnectWise applications.
IPV4	`187[.]15[.]88[.]186`	Listed as a VPN IP observed accessing Graph API through compromised applications; the article says it is transient and relevant to investigation on October 15 and 16.
IPV4	`187[.]15[.]89[.]186`	Listed as a VPN IP observed accessing Graph API through compromised applications; the article says it is transient and relevant to investigation on October 15 and 16.
IPV4	`187[.]15[.]90[.]217`	Listed as a VPN IP observed accessing Graph API through compromised applications; the article says it is transient and relevant to investigation on October 15 and 16.