ItInsightsWorld Security Playbook: ConnectWise, ARTEX, and Storm-0940 in a Microsoft 365 Supply Chain Attack
A trusted vendor connection can become the fastest path into a cloud estate. The Microsoft report published on 21 October describes the ConnectWise supply chain attack as work by Storm-0940, a China-aligned hacking group that used ARTEX AI agents since at least September 2026 to accelerate attempts against Microsoft 365 environments.
For defenders, the operational question is how an application identity that already had access can be abused without a user entering a password. The answer, in this case, involves credentials tied to ConnectWise cloud applications and authentication attempts against more than 2,250 Microsoft 365 tenants.
Incident snapshot for defenders
| Finding | Security meaning for operations teams |
|---|---|
| Microsoft report dated 21 October | ConnectWise supply chain activity was linked to Storm-0940, a China-aligned hacking group, with ARTEX described as used since at least September 2026. |
| Abused application credentials | Attackers attempted to authenticate to more than 2,250 Microsoft 365 tenants by using permissions already granted to ConnectWise cloud applications. |
| ARTEX architecture | A multi-agent offensive system with a Go backend and a Next.js interface that can work with different AI models and automate reconnaissance, vulnerability discovery, and exploitation. |
| Separate password-spraying activity | Between 10 and 14 October, Storm-0940 targeted 327 accounts at eight organisations. More than 151,000 authentication attempts failed, with a peak of 2,900 failures per minute, and Microsoft found no successful authentication in that campaign. |
| Cloud follow-on activity | In some tenants, Microsoft Graph was used for reconnaissance, credential changes, and attempts to alter privileges. |
| Backup service disruption | ConnectWise said on 14 October that it discovered unauthorised access involving application identities for Cloud Backup, previously known as SkyKick, then suspended Cloud Backup, SaaS Security, and Cloud Management because of shared integrations. |
| Recovery window | ConnectWise's 23 October security update said restoration testing was expected to continue through the weekend, with access to existing backups potentially returning in phases the following week. |
Why application identities are the central risk
The ConnectWise supply chain attack did not depend on the same path as ordinary password guessing. Attackers authenticated as trusted third-party applications, using access those applications had already been granted. That can bypass the need for an interactive user sign-in and can make suspicious activity look, at first, like legitimate application access.
Microsoft cautioned that a successful application sign-in does not, by itself, establish that customer data was accessed or stolen. The warning also covered persistence: even after the original compromised connection has been disabled, credentials added to other applications can preserve unauthorised access.
This is why tenant-level verification is necessary. Individual Microsoft 365 tenants need investigation for persistent credentials, unexpected privilege assignments, and unauthorised activity, even when the service provider reports that backup archives remain encrypted and isolated with no indication of compromise.
What ARTEX changes about the attack tempo
ARTEX is described as a multi-agent system that applies large language models to offensive security work. Although its intended use is penetration testing, the same automation can be directed toward malicious activity with relatively little human intervention. Microsoft reported that Storm-0940 relied on ARTEX since at least September 2026, and that privileged cloud access was obtained within three hours of initial targeting in several ARTEX-assisted attacks.
The technical shape of the framework matters for defenders who evaluate tooling risk: ARTEX has a Go backend, a Next.js interface, and compatibility with different AI models. The more important point is strategic. eeNews Europe reporting has examined the growing role of AI in attacks, and the ConnectWise supply chain attack appears to be an example of AI accelerating established cybercrime techniques rather than introducing an entirely new entry method.
Security checklist: immediate verification tasks
- Identify all ConnectWise cloud application connections in the tenant, especially those linked to Cloud Backup, SaaS Security, and Cloud Management.
- Keep affected application connections disabled until ConnectWise authorises their restoration.
- Preserve sign-in and audit records before containment work changes the log environment.
- Review permissions already granted to third-party applications and determine which permissions can be exercised without interactive user sign-in.
- Search for persistent credentials added to other applications after the original compromise path is disrupted.
- Examine Microsoft Graph activity for reconnaissance, credential changes, and attempts to alter privileges.
- Investigate every affected Microsoft 365 tenant independently instead of relying only on vendor-level statements.
Common misconceptions
- Misconception: This was only a password-spraying incident. Reality: The password-spraying campaign targeted 327 accounts at eight organisations, but the ConnectWise supply chain attack used trusted application credentials and application permissions.
- Misconception: Disabling the original connection ends the exposure. Reality: Microsoft warned that credentials added to other applications can preserve unauthorised access even after the original compromised connection has been disabled.
- Misconception: Successful application authentication proves theft. Reality: Microsoft cautioned that a successful application sign-in does not, by itself, establish that customer data was accessed or stolen.
- Misconception: AI created a new type of intrusion. Reality: The reporting described AI speeding up established techniques, not a wholly new route into organisations.
Action advice for IT administrators and security teams
Start with containment that matches the abuse path: disable affected ConnectWise application connections, preserve evidence, and continue tenant investigation for persistent credentials and unexpected privilege assignments. Then use the recovery information carefully. ConnectWise reported on 23 October that restoration testing was expected to continue through the weekend, with access to existing backups potentially returning in phases the following week.
The final priority should be verification, not reassurance. A tenant should not assume it was untouched merely because more than 2,250 Microsoft 365 tenants were targeted through the same third-party application pattern. The same reasoning applies to AI-assisted campaigns: faster automation increases the need for audit-grade visibility, not because the attack is mysterious, but because the abuse is already recognizable once application identities are reviewed.
FAQ
Who is Storm-0940 in this reporting?
Microsoft described Storm-0940 as a China-aligned hacking group linked to the ConnectWise supply chain attack and associated with ARTEX-assisted operations.
How did the attackers try to reach Microsoft 365 environments?
They attempted to authenticate to more than 2,250 Microsoft 365 tenants using credentials tied to ConnectWise cloud applications and permissions already granted to those applications.
Was the password-spraying effort successful?
Between 10 and 14 October, Microsoft observed More than 151,000 authentication attempts against 327 accounts at eight organisations, with a peak of 2,900 failures per minute, and found no successful authentication in that campaign.
What did ConnectWise suspend?
ConnectWise suspended Cloud Backup and, because they share integrations, SaaS Security and Cloud Management.
Does the incident prove customer data was stolen?
No. Microsoft's guidance says a successful application sign-in does not, by itself, establish that customer data was accessed or stolen.
Closing security takeaway
The ConnectWise supply chain attack is a practical case study in how trusted software connections can turn into cloud access opportunities. It also shows why a Security team should track both attacker tooling and vendor recovery status: ARTEX, a Go and Next.js-based agentic framework, was used since at least September 2026, while Microsoft's 21 October reporting emphasized attempts against more than 2,250 Microsoft 365 tenants, follow-on Microsoft Graph activity, privileged access obtained within three hours, and ConnectWise recovery milestones beginning 14 October and continuing through the weekend and the following week.