Microsoft: Storm-0940 used ARTEX in ConnectWise supply-chain attack

Microsoft said on October 21, 2026 that it assesses Storm-0940, which it calls "a China-state aligned actor," was responsible for the supply-chain compromise of ConnectWise Cloud Backup, formerly SkyKick. In its Security Blog post, Microsoft says the actor used ARTEX, an AI agent penetration testing framework, "to automate attacks targeting hundreds of organizations globally across a broad range of industries."

#What changed?

ConnectWise disclosed the Cloud Backup compromise in October. Microsoft's post adds an attribution, which it presents as an assessment: "Microsoft assesses that Storm-0940 was responsible" for the compromise. Microsoft says Storm-0940 "has been active since 2021 and targets organizations across multiple industries for data theft." CyberScoop independently reported the attribution.

#What ARTEX is

Microsoft describes ARTEX as "an open-source penetration testing framework that can use any AI model to automate a variety of offensive security workflows." Reuters reported on October 9, 2026 that "The Chinese developer of Artex has converted the AI agent to a closed-source project," after a statement the developer posted on October 8. Reuters also said "Artex’s GitHub page has been taken down."

Microsoft says ARTEX is not limited to one group: "Microsoft Threat Intelligence has identified threat actors across multiple geographic regions leveraging the ARTEX framework."

#What Microsoft says happened

According to Microsoft, Storm-0940 used ARTEX "to accelerate scanning and reconnaissance, password spraying, and OAuth application abuse at downstream victims." Microsoft says the actor used stolen ConnectWise application credentials to reach customer Microsoft 365 environments where those apps already had access, which "allowed the threat actor to operate without requiring an interactive user sign-in."

The figures are Microsoft's:

• Sign-in attempts: Storm-0940 used ARTEX "to attempt to sign-in to more than 2,250 tenants at 2,900 sign-in attempts per minute." Microsoft says "the majority of the targeting wasn’t successful," but that the actor "achieved privileged cloud persistence at many organizations in a brief time."
• Speed: Microsoft says there were "multiple instances where the time from initial targeting to privileged access was less than 3 hours."
• Earlier password spray: Microsoft says a separate password-spray campaign between October 10 and 14, 2026 targeted 327 accounts across eight organizations. It counted "151,000+ failed logon events, with activity peaking on October 11 at 2,900 failures per minute," and says "no successful authentication, token issuance, Graph call, or directory change was observed."

Microsoft also says the activity "did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services." It adds that "the presence of an affected application or successful threat actor authentication does not necessarily indicate that customer data was accessed or exfiltrated."

#Who is affected and when?

The campaign hit customers of ConnectWise Cloud Backup, which BleepingComputer describes as backup and recovery services for managed service providers and IT teams. Dates from ConnectWise and Microsoft:

ConnectWise says SaaS Security and Cloud Management were also suspended "out of an abundance of caution," and that "A service suspension does not, by itself, mean that a partner or customer environment was compromised." It expects "restoration to take several days."

#How many were compromised?

Sources give different pictures, and none gives a definitive total:

• Microsoft gives no count of compromised customers, CyberScoop reported.
• Huntress, a security company, "confirmed unauthorized sign-ins in 162 tenants and said additional compromises beyond its telemetry are likely," CyberScoop reported on October 20, 2026. A Huntress analyst told CyberScoop it had seen sign-in activity from the malicious infrastructure across almost 1,000 Entra tenants, with more than 300 of those sign-ins appearing to succeed.
• ConnectWise says: "We have not identified confirmed downstream customer compromise. However, the investigation remains ongoing, and the absence of confirmed compromise is not assurance that no unauthorized activity occurred."

#What ConnectWise says

ConnectWise's advisory says "it appears that a China state-aligned group was responsible for the attack on ConnectWise Cloud Backup," based on evidence that includes "threat intelligence shared by Microsoft." ConnectWise says "Existing backup archives remain encrypted, isolated, and preserved, with no indication of compromise," and "We have no indication that other ConnectWise products, services, or offerings are impacted by this incident." It says how the credential was first exposed "remains under investigation."

#What should affected customers do?

Microsoft's guidance, at a high level:

1. "Keep affected ConnectWise application connections disabled until ConnectWise provides formal restoration instructions."
2. "Do not delete enterprise applications as the first response. Preserve configuration and evidence before making irreversible changes."
3. "Review activity starting from at least October 15, 2026," and extend service principal sign-in review to October 1 where records allow.
4. Investigate unexpected application credential or privilege changes. Microsoft warns such changes "can remain active as a backdoor" after the original application is fixed.
5. "Apply least privilege to multi-tenant application permissions and consent grants."

ConnectWise adds that "Individual Microsoft 365 tenants still require review for unauthorized changes or persistent access."

#How does it compare?

ARTEX has appeared in separate cases before. CrowdStrike reported on October 7, 2026 that an actor used ARTEX against South Korean finance targets, and said "this activity has not been attributed to a named adversary." Kyodo News reported on October 20, 2026 that a China-linked AI agent was used in attacks on firms in Japan. No source links those cases to Storm-0940.

For more on agent security, see our coverage of Microsoft's agentic insider security controls and the OpenCode console breach. More is in our Privacy and Security hub.

#What is still unclear?

• How many customers were compromised. Neither Microsoft nor ConnectWise gives a number.
• Whether data was taken. Microsoft and ConnectWise both say a sign-in alone does not show data access.
• The root cause. ConnectWise says how the credential was exposed is still under investigation.
• Full restoration. ConnectWise expects it to take several days.
• Which AI models Storm-0940 used with ARTEX. Microsoft does not say.