The Pulse
Microsoft Links ConnectWise Attack to China-Aligned Storm-0940
Microsoft attributes the ConnectWise Cloud Backup supply-chain compromise to China-state-aligned Storm-0940, which used ARTEX to accelerate attacks against customer Microsoft 365 environments. ConnectWise said phased service restoration had
AI.info Team · Written with AI · fact-checked ·
Microsoft names Storm-0940; ConnectWise weighs in
Microsoft attributes the ConnectWise Cloud Backup supply-chain compromise to Storm-0940, a China-state-aligned group, and says the attackers used the ARTEX AI framework to speed operations across Microsoft 365 environments. ConnectWise’s advisory, updated October 22, says the company’s assessment—based in part on intelligence from Microsoft—is that a China-aligned group appears responsible. The two companies draw a sharp distinction between the compromised service and what remains unknown: ConnectWise says its stored backup archives show no indication of compromise, while Microsoft describes suspicious activity inside multiple customer tenants.
Microsoft’s October 21 report says Storm-0940 had used ARTEX from as early as September to automate attacks against hundreds of organizations worldwide. It assessed that the group was responsible for the recently disclosed compromise of a ConnectWise multi-tenant application. Microsoft says its report concerns abuse of ConnectWise application credentials, not a vulnerability or compromise in Microsoft’s own systems.
AI agents accelerated access through trusted applications
ARTEX is an open-source, multi-agent penetration-testing framework written in Go that can use different AI models. Microsoft describes it as able to automate workflows from reconnaissance to data exfiltration with little human input. In the ConnectWise campaign, the agents accelerated scanning, reconnaissance, password spraying and misuse of OAuth applications in downstream environments.
That route matters because the ConnectWise applications already had permission to access customer Microsoft 365 tenants. Microsoft says attackers used that existing trust to authenticate without an interactive user sign-in. In some affected environments, the agents moved on to Microsoft Graph and directory operations, including reconnaissance, changes to application credentials, and attempts to alter identities, groups and privileged roles.
“The presence of an affected application or successful threat actor authentication does not necessarily indicate that customer data was accessed or exfiltrated,” Microsoft Security Research and Microsoft Threat Intelligence, the report’s authors, write.
Microsoft says it found evidence of follow-on activity in multiple customer environments, but does not say that every affected authentication led to data access or theft.
Microsoft separates the password-spray figures
Microsoft also details an automated password-spraying campaign between October 10 and 14. It targeted 327 accounts at eight organizations and generated more than 151,000 failed logon events; Microsoft says it observed no successful authentication, token issuance, Graph call or directory change during that campaign. The report identifies that activity as preceding the ConnectWise compromise, rather than proof that those password-spray attempts succeeded.
Separately, Microsoft says Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 tenants after the ConnectWise application credentials were acquired. The company warns that the volume and speed of AI-assisted operations can leave defenders little time to investigate alerts and remove unauthorized access. It also says some ARTEX-driven attacks against organizations resulted in privileged cloud access in under three hours.
Restoration does not settle tenant-by-tenant exposure
ConnectWise says it identified unauthorized access to application credentials associated with Cloud Backup. In an October 20 update, the company said it had completed a full reset of all accounts and credentials in the affected Cloud Backup environment. Its October 21 update at 12:45 UTC said phased restoration had begun and could take several days; partners should keep affected connections disabled until they receive formal instructions.
ConnectWise’s October 21 update at 00:30 UTC said Cloud Backup, SaaS Security and Cloud Management remained suspended. The company says its existing backup archives remain encrypted and isolated, with no indication they were compromised. That finding does not resolve whether a customer’s live Microsoft 365 tenant was accessed or altered: the company says each partner and customer tenant still requires its own review.
Microsoft advises administrators to examine service-principal sign-ins, application credential changes, permissions and directory activity, and to preserve relevant logs during investigation. ConnectWise likewise directs partners to review their own and managed customer tenants. The service restoration and the tenant investigations are separate steps; restoring the vendor platform does not, by itself, establish whether unauthorized access persisted in a customer environment.