Storm-0940 used compromised ConnectWise application identities for cloud access; Microsoft says some targets reached privileged access in under three hours.
By [Ryan Merket](https://runtimewire.com/author/ryan-merket)
· Published
Primary source: [X](https://x.com/MsftSecIntel/status/2112975078266716390)
Why it matters #
The incident shows how a compromise of a trusted multi-tenant application can turn existing cloud permissions into a fast route across customer environments, while service shutdowns disrupt the backup and security tools those customers rely on.
Microsoft says China-aligned threat actor Storm-0940 used the agentic penetration-testing framework ARTEX to exploit compromised ConnectWise application identities and reach more than 2,250 customer tenants, with activity peaking at 2,900 sign-in attempts per minute. In its October 21st analysis, Microsoft said some attacks reached privileged cloud access in under three hours. The company said the actor’s use of ARTEX was observed as early as September 2026.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.