Credentials for ConnectWise cloud applications gave attackers a route into customers’ Microsoft 365 environments through permissions those applications already held. Microsoft assesses that Storm-0940, which it describes as a China-state aligned actor, was responsible for the supply chain compromise and used the ARTEX agentic AI penetration testing framework to accelerate the intrusions.
Microsoft’s October 21 report documents successful authentication and further activity in multiple customer environments. Because the attackers operated through authorized application identities, access did not require an interactive user sign-in.
The distinction between authentication and data exposure remains significant. Microsoft cautioned that neither an affected application’s presence nor a successful attacker sign-in necessarily establishes that customer data was accessed or exfiltrated.
Failed password attacks preceded application abuse
Before the application credentials were used, Storm-0940 conducted a password-spraying operation between October 10 and 14, according to Security Affairs’ account of Microsoft’s findings. More than 151,000 failed login attempts targeted 327 accounts across eight organizations. None succeeded.
By October 15, the attackers were using compromised credentials for several ConnectWise cloud applications to authenticate to customer environments. The failed password attempts do not establish how those application credentials were obtained.
ARTEX helped automate reconnaissance, password spraying and OAuth application abuse. SecurityWeek reported, citing Microsoft, that the actor attempted sign-ins to more than 2,250 tenants after gaining unauthorized access. That figure describes attempted access, rather than a count of confirmed compromises.
Separately, SecurityWeek cited Huntress observations of attackers accessing hundreds of Microsoft 365 tenants, including more than 300 Entra tenants, with compromised ConnectWise application credentials. ConnectWise suspended Cloud Backup, SaaS Security and Cloud Management among several services in response to the mid-October activity, the publication reported.
Directory changes complicated containment
In multiple environments, Microsoft traced activity beyond the initial sign-in into Microsoft Graph. The observed operations included reconnaissance and application credential changes, alongside attempts to alter privileges that could expand or prolong access. Reporting also described operations involving identities, groups and privileged roles.
Those credential changes create a persistence concern: access established through attacker-added credentials can survive remediation of the application originally compromised, according to Microsoft. Investigating the initial sign-in alone would therefore leave subsequent directory changes unexamined.
Microsoft recommends correlating service principal sign-ins with Microsoft Graph operations, directory modifications and resource access. Investigators should check unexpected credential or privilege changes against authorized administrative activity, follow ConnectWise’s published containment guidance and preserve investigation evidence.
Defender XDR detections and hunting queries support that work. Microsoft also cautions that an empty Graph activity search does not prove access never occurred; investigators need to consider application permissions and service principal authentication records alongside Graph telemetry.
Part of a wider ARTEX campaign
Microsoft observed Storm-0940 using ARTEX against hundreds of organizations worldwide as early as September 2026. Several attacks in that broader activity produced privileged cloud access, with multiple cases taking less than three hours from initial targeting to privileged access. That timing was not established for every ConnectWise intrusion.
Storm-0940 has operated since at least 2021, according to SecurityWeek. ARTEX supplied automation for its offensive workflows, while the ConnectWise intrusions relied on compromised application identities and their existing permissions. Microsoft said the activity did not stem from a compromise of, or vulnerability in, its corporate systems, products or services.
