On October 21, 2026, Microsoft attributed the compromise of ConnectWise application identities to China-state-aligned actor Storm-0940 and reported attempted sign-ins to more than 2,250 Microsoft 365 tenants. Microsoft said most targeting was unsuccessful, but it observed follow-on activity in multiple customer environments, and several attacks reached privileged cloud access, in some cases less than three hours after targeting began.
The 2,250-plus figure counts tenants targeted by sign-in attempts, not confirmed breaches. Microsoft also said an affected application or successful authentication alone does not establish that customer data was accessed or exfiltrated.
Two operations, with different results
Microsoft described the ConnectWise application-identity activity as separate from a password-spray operation that ran from October 10 through 14, 2026. A password spray tries a small set of passwords against multiple accounts. Microsoft placed the reported peak of 2,900 failed attempts per minute in that separate operation, on October 11.
| Operation | Period and method | Microsoft-reported scope and results |
| ConnectWise application-identity activity | From October 15, using compromised ConnectWise application identities that already had access to customer environments | Sign-in attempts reached more than 2,250 tenants. Most targeting was unsuccessful; Microsoft observed follow-on activity in multiple environments, and some attacks reached privileged cloud access. |
| Separate password-spray operation | October 10–14, targeting accounts with password guesses | 327 accounts across eight organizations; more than 151,000 failed logon events, including more than 111,000 in one day. Forty-eight accounts had more than 1,000 failed attempts. Lockout responses accounted for nearly 98% of activity. Microsoft observed no successful authentication, token issuance, Graph call or directory change. The peak was 2,900 failed attempts per minute on October 11. |
The high per-minute rate belongs to the password spray, not the ConnectWise application-identity activity. The operations also had different outcomes: Microsoft observed no successful authentication or follow-on changes in the spray, while it reported follow-on activity in multiple environments after the ConnectWise identities were used.
How ARTEX and existing app access figured in the activity
Microsoft described ARTEX as an open-source, multi-agent framework for penetration testing that uses large language models (LLMs). It can automate offensive workflows, including reconnaissance and application abuse, with little human interaction. Microsoft said Storm-0940 used ARTEX to automate attacks as early as September 2026.
Rather than relying on individual users to sign in, Storm-0940 used ConnectWise applications that already had access to downstream customer environments. Microsoft observed reconnaissance through Microsoft Graph, changes to application credentials and attempted changes involving identities, groups and privileged roles. Several attacks reached privileged cloud access, sometimes in less than three hours from initial targeting.
ConnectWise’s service response and backup archives
ConnectWise suspended Cloud Backup, SaaS Security and Cloud Management, disabled seven application identities, and reset accounts and credentials in the affected Cloud Backup environment. The company said its existing backup archives remained encrypted, isolated and preserved, with no indication they had been accessed. That statement concerns stored archives; Microsoft separately reported activity in multiple customers’ live environments.
In an update dated October 22 in Eastern time, or October 23 UTC, ConnectWise described restoration as staged and conditional on testing and validation. The company said access to restore existing backups was anticipated early the following week, subject to successful validation, with full service re-enrollment to follow in phases.
What Microsoft advised Microsoft 365 administrators to review
Microsoft recommended that administrators review service-principal sign-ins, then check related Microsoft Graph and directory activity for unexpected application-credential additions, privilege assignments and resource access. It also advised preserving records and other evidence. ConnectWise said affected connections should remain disabled until it provided formal reconnection instructions.
