Microsoft has attributed the ConnectWise Cloud Backup compromise to Storm-0940, a China-aligned threat group, and says the operators used an agentic AI penetration testing framework named ARTEX to reach more than 2,250 Microsoft 365 tenants. ConnectWise began a phased restoration of the service on Wednesday and told customers recovery would take several days.
Microsoft Research Names Storm-0940 as the Group Behind the Attack
Microsoft described Storm-0940 as a China state-aligned group that has been active since 2021. The company’s research, published Wednesday, adds attribution and scale to an outage that ConnectWise first disclosed days earlier, when the vendor advised customers to disable their Cloud Backup connections and shut down services on October 19.
Microsoft said the group’s activity reached more than 2,250 tenants. At its peak, the campaign generated about 2,900 failed sign-in attempts per minute.
ARTEX: An Agentic AI Framework for Reconnaissance, Spraying and OAuth Abuse
According to Microsoft, ARTEX is an agentic AI penetration testing framework that automates three stages of the operation: reconnaissance, password spraying and OAuth abuse. Microsoft dated the start of ARTEX deployment to early September 2026, ahead of the October password-spraying burst that preceded the ConnectWise compromise.
Microsoft reported sign-in failures peaking at about 2,900 per minute during the campaign. The research also lists Storm-0940’s activity as running since 2021, which places ARTEX as a recent addition to an established group’s toolkit rather than the start of its operations. Early September is also the point at which Microsoft says ARTEX deployment began, roughly five weeks before the spraying burst.
The October 10–14 Password-Spraying Campaign
Microsoft documented a password-spraying campaign that ran from October 10 to 14. It hit 327 Microsoft 365 and Exchange Online accounts across eight organizations and produced more than 151,000 failed logons. ConnectWise Cloud Backup was compromised on October 15, the day after the spraying window closed.
Sectors Storm-0940 Targeted
Microsoft listed a broad set of targeted industries: aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, semiconductors, technology, think tanks and nonprofits. The list spans both defense-industrial organizations and commercial sectors that hold intellectual property.
ConnectWise Restoration and Customer Impact
ConnectWise started a phased restoration on October 21 and warned customers that recovery would take several days. Before that, the company had advised customers to disable their connections to Cloud Backup. The result has been a multi-day outage of a backup service for the tenants that depend on it.
The attribution is new relative to earlier coverage of the outage, which reported 173 affected tenants and did not name a threat actor. Microsoft’s figure of more than 2,250 targeted tenants refers to the wider scope of Storm-0940’s targeting, which is separate from the earlier count of affected tenants.
Response From Microsoft
Microsoft published its research along with indicators of compromise. ConnectWise’s response so far consists of the phased restoration and guidance to customers on their connections. Neither company has described the full set of data exposed through the Cloud Backup compromise.
Timeline of the Storm-0940 Operation
Microsoft’s account places the events in sequence: ARTEX deployment began in early September; the password-spraying campaign ran from October 10 to 14; ConnectWise Cloud Backup was compromised on October 15; ConnectWise shut down services on October 19; and Microsoft published its attribution on October 21, the same day ConnectWise began restoring service.
Impact
More than 2,250 tenants in sensitive industries were targeted, and a backup service stayed offline for several days. The attribution ties a managed-service supply chain compromise to a state-aligned group, with sign-in attempts peaking near 2,900 per minute. Whether ConnectWise or Microsoft will publish a breakdown of confirmed victims within that group of tenants has not been stated.
