Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group

Microsoft Security Research attributed the ConnectWise Cloud Backup supply-chain attack to a China-state-aligned threat actor it tracks as Storm-0940, which used the open-source agentic AI penetration testing framework ARTEX to automate attacks on hundreds of organizations globally starting as early as September 2026. In a four-day password-spraying campaign ending Oct. 14, Storm-0940 hit 327 Microsoft 365 and Exchange Online accounts across eight organizations with more than 151,000 failed logon attempts peaking at 2,900 per minute, then used AI agents to reach more than 2,250 tenants at 2,900 sign-in attempts per minute in the ConnectWise campaign, Microsoft said in an Oct. 21 blog post. Microsoft did not say how many customers were compromised, and ConnectWise, which shut down services Saturday, said Wednesday it began restoring services in phases and expects recovery to take several days.

Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group Microsoft researchers attributed the recent supply-chain attack targeting ConnectWise customers https://cyberscoop.com/connectwise-cloud-backup-supply-chain-attack/ ’ Microsoft 365 environments to a China-state aligned threat actor it tracks as Storm-0940. “As early as September 2026, Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries,” Microsoft Security Research wrote in a blog post https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/ Wednesday. The nation-state group, which has been active since 2021, targeted organizations in aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks and non-profits. Storm-0940 initiated a widespread, but ultimately unsuccessful, password-spraying campaign immediately preceding the compromise of ConnectWise’s Cloud Backup service. During a four-day stretch ending Oct. 14, Storm-0940 targeted 327 Microsoft 365 and Exchange Online accounts across eight organizations, researchers said. During that short campaign, Microsoft observed more than 151,000 failed logon attempts, peaking at 2,900 failures per minute. Storm-0940 set its sights on ConnectWise the next day, using AI agents and the same malicious infrastructure to compromise a series of ConnectWise Cloud Backup customers’ Microsoft 365 environments. Storm-0940 gained significant advantages in the ConnectWise supply-chain campaign by using ARTEX to accelerate scanning, conduct password-spray attacks and abuse OAuth applications in downstream victims, according to Microsoft. “In some of these environments, the AI agents on behalf of the threat actor progressed beyond authentication to Microsoft Graph and directory operations, including reconnaissance, application credential modifications to establish persistence, and changes involving identities, groups, and privileged roles,” researchers wrote. “Microsoft identified multiple customer environments with evidence of follow-on activity, highlighting how a compromised third-party application with high privileges could provide access beyond its originally intended purpose.” Microsoft Threat Intelligence said multiple threat actors from various regions are using ARTEX to strengthen capabilities and speed up the tempo of attacks. The open-source penetration testing framework works with any AI model to automate various offensive security workflows, the company said. “ARTEX is a system of LLM-driven agents that run an autonomous penetration test from reconnaissance through data exfiltration with little needed human interaction.” In the ConnectWise campaign, Microsoft said “Storm-0940 used ARTEX to reach more than 2,250 tenants at 2,900 sign-in attempts per minute, a pace that leaves defenders with little time to detect and respond.” Microsoft did not say how many customers were compromised, adding that successful authentication doesn’t necessarily indicate Storm-0940 accessed or stole data. Yet, researchers said the threat group’s AI agents could also gain persistent access and establish backdoors by modifying credentials in targeted victims’ environments. ConnectWise, which temporarily shut down services Saturday in the wake of the attacks, said it began restoring services https://www.connectwise.com/company/trust/advisories in phases Wednesday. The company advised customers to keep connections disabled and said it expects the recovery process to take several days. “Since early October, a wave of AI-driven cyberattacks has been ongoing,” Igor Tsyganskiy, executive vice president at Microsoft, wrote in a LinkedIn post https://www.linkedin.com/feed/update/urn:li:activity:7518751939463966720/ Wednesday. The ConnectWise supply-chain attack is just “one of many,” he added.