Microsoft assessed on October 21, 2026, that China-state-aligned actor Storm-0940 was responsible for a compromise involving ConnectWise Cloud Backup and used the ARTEX framework to accelerate activity against customer Microsoft 365 environments. Microsoft reported attempted sign-ins to more than 2,250 tenants in the later campaign, but that figure counts attempts, not confirmed compromises.
What Microsoft attributed to Storm-0940
Microsoft’s October 21 report said Storm-0940 had used ARTEX as early as September 2026. ARTEX is an open-source framework that uses multiple large language model agents for penetration testing. Microsoft said Storm-0940 used it to speed up scanning, reconnaissance, password spraying and abuse of OAuth applications.
Two separate paths into Microsoft 365
Microsoft described a password-spraying campaign against user accounts and later activity using ConnectWise application credentials. Password spraying means trying passwords across multiple accounts. The two campaigns involved different identities and produced different observations.
| Campaign | Identity involved | Activity Microsoft reported |
| Password spraying, October 10–14, 2026 | User accounts | More than 151,000 failed logon events against 327 accounts across eight organizations. Microsoft observed no successful authentication, token issuance, Microsoft Graph call or directory change in this campaign. |
| Later ConnectWise campaign | ConnectWise Cloud Backup application credentials used for app-only authentication | Attempted sign-ins to more than 2,250 tenants, at a reported rate of 2,900 attempts per minute. |
App-only authentication uses an application identity rather than an individual customer’s account. Microsoft reported that, after authentication, it observed reconnaissance through Microsoft Graph, application credential changes and attempts to change privileges in multiple customer environments.
Huntress separately reported that, in one tenant, the ConnectWise Cloud Management - MS Teams application assigned itself the Global Administrator role and added credentials to two other applications. That is a documented example from one tenant, not a description of what happened in every environment.
Authentication does not establish data theft
A successful application sign-in does not, by itself, show that customer data was accessed or exfiltrated. Microsoft reported follow-on activity in multiple environments but did not disclose a count of customers whose data was accessed or stolen.
The incident accounts identify ConnectWise Cloud Backup and related cloud-management application identities as involved in the activity. ConnectWise’s statements about stored backup archives concern those archives; Microsoft’s observations of Graph and directory activity concern customer Microsoft 365 environments.
ConnectWise’s response and what administrators should review
ConnectWise said it identified unauthorized access to application identities on October 14, 2026. The company said it suspended Cloud Backup, revoked certificates for affected application connections and invalidated shared Cloud Backup credentials. In its October 17 update, ConnectWise said stored archives remained encrypted and isolated, with no evidence that they had been accessed.
Microsoft recommends reviewing service-principal sign-ins, meaning sign-ins by application identities, along with Microsoft Graph activity, application credential changes, consent grants, privileged-role assignments and directory audit records. Huntress also recommends checking affected ConnectWise and SkyKick integrations, including dormant ones, and reviewing credentials and roles for unexpected changes. It advises disabling affected application connections rather than deleting them and preserving relevant tenant records during the investigation.
