Microsoft says Storm-0940 ran ARTEX to break into ConnectWise and 2,250 tenants

A Microsoft 365 tenant that trusted a ConnectWise cloud app in October is now a tenant that needs to look at every sign-in since the first of the month. Microsoft Security Research and Microsoft Threat Intelligence published the attribution on 21 October, naming Storm-0940, a China-state aligned actor active since 2021, as the operator behind what Microsoft calls "the recently disclosed ConnectWise supply chain compromise of a multi-tenant application". Microsoft says Storm-0940 used an open-source penetration testing framework called ARTEX to automate the attack.

What ARTEX did, in Microsoft's words

Microsoft describes ARTEX as "an open-source penetration testing framework that can use any AI model to automate a variety of offensive security workflows". The post says Storm-0940 used it to run password spraying, OAuth application abuse and reconnaissance across many tenants at once. Microsoft says the actor reached "privileged access to an organization's cloud infrastructure" in "less than 3 hours" in multiple instances. Attack activity started "as early as September 2026".

The scale of the automated side is specific. Between 10 and 14 October 2026, Microsoft observed Storm-0940 infrastructure at 144.172.64[.]99 running "an automated cross-tenant password-spray campaign targeting 327 accounts across eight organizations". A separate ARTEX campaign ran at 2,900 sign-in attempts per minute against more than 2,250 Microsoft 365 tenants. Microsoft lists aerospace, defence, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, think tanks and nonprofits among the industries targeted.

The ConnectWise part

Storm-0940 "acquired control of the identities of multiple ConnectWise cloud applications", in Microsoft's words. On 15 October the actor began using those identities to reach customer environments downstream of ConnectWise, and ConnectWise published its vendor advisory on 16 October. The post ties the compromise to four application IDs that any affected tenant will have granted consent to at some point.

Microsoft's recommendation is explicit on one point. "Keep affected ConnectWise application connections disabled until ConnectWise provides formal restoration instructions." The post does not state a CVE for ConnectWise, and attribution beyond "China-state aligned" is not given.

What a defender has to do today

Microsoft's checklist is written for a Microsoft 365 administrator, and it is a list of specific places to look rather than a general warning. Inventory the four application IDs and record the service-principal Object IDs. Review Microsoft 365 tenants where any of the four apps were installed or authorised. Investigate service principal sign-ins from 1 October onward. Review Microsoft Entra audit records for credential additions and privilege changes. Check Microsoft 365 audit logs for reconnaissance and unusual resource access. Preserve logs before any irreversible change.

The claim behind the item is that an open-source agent framework and a trusted vendor relationship were enough to put thousands of Microsoft 365 tenants in range of one actor over about three weeks. If a team has nothing to do with ConnectWise, the specific IOCs do not apply. The pattern does: a supply chain app with multi-tenant consent and an automated sign-in rate of thousands per minute leaves very little time between discovery and privileged access, and the trail will be in sign-in logs rather than in email.

Source

Microsoft Security Blog: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise. The Information carried a short briefing on this attribution the same day.