ConnectWise supply-chain compromise pinned on China's Storm-0940

Microsoft attributes the compromise of a ConnectWise multi-tenant cloud application to Storm-0940, a China state-aligned actor, in a blog post published 21 October 2026. The novel part is the tooling: Storm-0940 drove ARTEX, an LLM-driven agentic penetration-testing framework, to spray credentials and seize application identities at machine speed — in some cases reaching privileged access in under three hours. If you run ConnectWise Cloud Backup or consume its M365 integrations, treat your tenant as in scope.

What Microsoft confirmed

Microsoft's advisory is the primary source. It describes two stages:

• Stage 1 — cross-tenant password spray. ARTEX agents attempted sign-ins "to more than 2,250 tenants at 2,900 sign-in attempts per minute." A preceding four-day spray targeting "327 accounts across eight organizations" peaked "on October 11 at 2,900 failures per minute," and "Microsoft telemetry captured 151,000+ failed logon events." Microsoft reports no successful authentication in that specific window.
• Stage 2 — stolen app identities. From 15 October 2026, the agents controlled identities for several ConnectWise cloud applications and authenticated into customer environments, in places pivoting to Microsoft Graph for reconnaissance, adding application credentials for persistence, and altering privileged roles and group membership. Microsoft notes "multiple instances where the time from initial targeting to privileged access was less than 3 hours."

ConnectWise's own statement, relayed by The Hacker News and CyberScoop, says the activity "describes a campaign that reaches well beyond any one company." It shut services down and is restoring them in phases over several days. No CVE is involved — this is identity and OAuth abuse, not a software flaw.

Attribution

Microsoft tracks the actor as Storm-0940 and previously linked it to the Quad7 / CovertNetwork-1658 botnet in November 2024, assessing activity since at least 2021. We keep the hedge: this is Microsoft's attribution. ARTEX was reportedly turned closed-source after use against South Korean financial institutions, and Microsoft says it has seen the framework in the hands of other actors across multiple regions — so ARTEX tradecraft is not a Storm-0940 signature on its own.

Indicators of compromise

Microsoft published these indicators (reproduced verbatim):

Sign-in / Graph activity IPs:   144.172.64[.]128, 144.172.64[.]99, 144.172.64[.]60
VPN / transient (Oct 15–16):    187.15.88[.]186, 187.15.90[.]217, 187.15.89[.]186
User agents:                    Python-urllib/3.12, python-requests/2.31.0,
                                python-requests/2.34.2, curl/7.88.1, azure-toolkit/1.0
Application IDs:                506e08f9-6e9a-4da4-942b-a099a03644ae (ConnectWise Cloud Backup)
                                24205314-2b89-4e07-a2a4-579e898a5640 (ConnectWise - MS Teams)
                                0de14c77-b9b0-4137-9360-34878a929827 (ConnectWise - MS Graph)

Microsoft explicitly warns "Do not limit review to the published IPs" — the agents rotated infrastructure.

Action checklist

1. Keep affected ConnectWise application connections disabled until ConnectWise issues formal restoration instructions. Do not delete the enterprise applications as a first response — you destroy evidence.
2. Review sign-in, Graph, and directory activity from at least 15 October 2026 forward, not only against the published IPs.
3. Audit OAuth applications for credentials, consent grants, owners, and role assignments added during the window; these are Storm-0940's persistence mechanism.
4. Apply least privilege to multi-tenant application permissions and consent grants.
5. Preserve evidence, then have an authorized responder remove confirmed unauthorized credentials, grants, and identities.

Context

This is the supply-chain pattern layered onto agentic AI: compromise one trusted multi-tenant vendor, inherit its reach into thousands of downstream tenants, and let an LLM-driven framework compress reconnaissance-to-privilege from days to hours. The 2,900-sign-ins-per-minute figure is the tell — defender playbooks built around human-paced intrusion assume a window that no longer exists. MSP and vendor integrations are trust paths; inventory them as attack surface, not convenience.