Microsoft has attributed the ConnectWise Cloud Backup supply chain compromise to Storm-0940, which it describes as a China-state aligned actor. According to Microsoft, the group used ARTEX, an agentic AI penetration testing framework, to automate attacks on hundreds of organizations worldwide starting as early as September 2026. In several cases the actor gained privileged access to an organization's cloud infrastructure, sometimes less than three hours after first targeting it. Using stolen application credentials tied to ConnectWise's Microsoft 365 backup service, the actor tried to reach downstream customer tenants. The number of tenants targeted is reported as "more than 2,200" in Dark Reading's summary, while the body of the same article and Security Affairs both put it at more than 2,250. Microsoft's published excerpt says only "hundreds of organizations." Microsoft also says most of the targeting failed but that Storm-0940 "achieved privileged cloud persistence at many organizations in a brief time."
What Happened
ConnectWise sells IT management and backup software to managed service providers (MSPs), including backup and restore for Microsoft 365 data. To provide that service, its applications hold authorized access to customer Microsoft 365 tenants. On October 16, ConnectWise disclosed unauthorized access to application identities linked to its Cloud Backup product, according to Dark Reading. It has since published further details and containment guidance. It has not said publicly how the attackers first took control of those application identities.
Microsoft's report, published October 21, links the ConnectWise incident to a wider Storm-0940 campaign. That campaign hit organizations in many sectors. Dark Reading names manufacturing and aerospace. Security Affairs adds defense, energy, financial services and government.
Security Affairs describes the sequence of events from Microsoft's report:
- October 10 to 14: A password spraying wave from 144.172.64[.]99 produced more than 151,000 failed sign-ins against 327 accounts at eight organizations. It peaked on October 11 at about 2,900 failed attempts per minute. Forty-eight accounts each took more than 1,000 attempts. None succeeded.
- October 15: The ARTEX-driven activity stopped password spraying and began abusing the ConnectWise application credentials, which Storm-0940 had obtained by then.
Timeline discrepancy: Security Affairs says the October 15 shift came "one day after the ConnectWise breach became public," which would put public disclosure around October 14. Dark Reading dates ConnectWise's disclosure to October 16. Defenders should rely on ConnectWise's own advisory for the authoritative date.
What Was Taken
None of the sources has published data volumes or confirmed specific stolen datasets. Microsoft's primary report describes follow-on activity through Microsoft Graph inside multiple affected tenants:
- Reconnaissance of tenant resources
- Changes to application credentials
- Attempts to change privileges that could have allowed expanded or persistent access
Because the compromised identities belonged to a Microsoft 365 backup product, they likely had broad read access to mail, files and other tenant data. Treat any tenant where these applications were active during the campaign as potentially exposed until it has been investigated. No source has said what data, if any, was exfiltrated from downstream customers.
Attribution caution: Several of the provided sources (Surefire Cyber, DeXpose, Undercode News, Insurance Business) cover the Storm ransomware group. That is a separate RaaS and extortion operation, first seen in August 2026, that has claimed victims such as Nipigon District Memorial Hospital, States Industries and Macquarrie Corporation. None of the sources connects it to Storm-0940, and the similar names should not be read as a link. The State Bank of India dark web exposure reported by The Hindu is also unrelated to this incident.
Why It Matters
Agentic AI changes how fast attacks move. Microsoft points out that AI agents "can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously." Going from target selection to privileged cloud access in under three hours leaves very little room for detection and response that relies on people.
One vendor exposed thousands of tenants. Trusted multi-tenant applications are already consented in customer environments. Once their credentials were compromised, the attacker could sign in to Microsoft 365 without any interactive user sign-in, so MFA and conditional access rules aimed at users never came into play.
The pivot was fast. Security Affairs reports that the actor dropped a noisy, failing password spray within about a day once a better access path was available. Defenders should expect AI-assisted operators to take advantage of new supply chain access much faster than human-led teams have in the past.
This is an established actor. Security Affairs says Storm-0940 has been active since 2021 and has long used password spraying and OAuth application abuse. ARTEX increased the scale of those existing methods rather than replacing them.
The Attack Technique
Microsoft's report and the outlet coverage describe the following:
- Automated reconnaissance and credential attacks: ARTEX, which Security Affairs calls open-source, ran large password spraying campaigns across many targets at once.
- Application identity abuse: Using compromised ConnectWise Cloud Backup application credentials, the actor authenticated to customer Microsoft 365 tenants as an application (service principal) that customers had already consented to. This required no user sign-in.
- Graph-based follow-on activity: Through Microsoft Graph, the actor enumerated tenant resources, added or changed application credentials, and tried to escalate privileges to keep access.
The initial access vector at ConnectWise has not been disclosed by ConnectWise or Microsoft.
What Organizations Should Do
- Audit ConnectWise and other backup app service principals. Review sign-in logs for the ConnectWise Cloud Backup applications from September 2026 onward, follow ConnectWise's containment guidance, and remove consent for any app you no longer need.
- Hunt for credential and permission changes. Check Entra ID audit logs for new client secrets or certificates on applications, new app role assignments, and changes to directory roles or Graph API permissions, especially changes made by service principals.
- Block and hunt the published IOC. Search sign-in logs for 144.172.64[.]99 and look for high-volume password spraying, such as thousands of failures per minute or more than 1,000 failures on a single account.
- Reduce third-party app privileges. Apply least privilege to multi-tenant apps, scope Graph permissions narrowly, and use Conditional Access for workload identities to restrict where service principals can authenticate from.
- Shorten response times. Attacks reach privilege in under three hours, so set up automated alerting and containment for anomalous service principal activity rather than relying on manual daily review.
- Ask MSPs what they did. If an MSP manages your environment, ask whether they used ConnectWise Cloud Backup and what containment steps they have taken.
Sources: AI-driven, large-scale nation-state campaign using ARTEX ... | Microsoft Links Storm-0940 to ConnectWise Supply Chain ... | Data breach: SBI says it individually informed all affected custome... | Microsoft Links ConnectWise Breach to China-Linked Group Using AI P... | Nipigon Hospital Confirms Patient Data Theft as Storm Ransomware Gr... | Storm Ransomware Strikes States Industries - DeXpose | Ransomware attack reaches Victorian business through external techn... | Threat Actor Deep Dive: Storm - Surefire Cyber