Storm-0940 Hits ConnectWise Cloud Backup with AI Attacks
Microsoft linked Storm-0940 to a ConnectWise supply chain compromise using ARTEX, an AI attack tool that ran automated intrusion at machine speed.
Marisol "Fuse" DelgadoMicrosoft on Wednesday disclosed that Storm-0940, a China state-aligned threat actor, compromised the ConnectWise Cloud Backup application’s supply chain using an AI-powered attack framework called ARTEX. ConnectWise took affected services offline and is working through a phased restoration.
What ARTEX is
ARTEX is a Go-based agentic AI framework designed for automated offensive operations. Its operators configured it with DeepSeek, GLM, and Grok AI models. Microsoft observed it running credential attacks, reconnaissance, and privilege escalation at what the company called “machine speed”: no pauses, no human delays between steps.
The tool was originally open-source. After researchers connected it to attacks targeting South Korean financial institutions, the maintainers pulled it closed-source. Storm-0940 already had a copy.
The attack
The campaign ran from September 2026 onward. The password spray phase logged from October 10 to 14: 327 accounts across eight organizations, 2,900 sign-in attempts per minute, and more than 151,000 failed authentication events over four days. The busiest single day was October 11, with 111,000 failures. Forty-eight accounts absorbed more than 1,000 attempts each. None of the spray attempts succeeded during that observed window.
What came after did. Microsoft says Storm-0940 reached privileged access in under three hours in several cases once footholds were established in the ConnectWise environment. From there, ARTEX agents abused OAuth application credentials to move into customer environments without triggering interactive sign-in alerts. Microsoft recorded attempts to modify more than 2,250 tenants.
Scope
Affected sectors span aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, and technology. ConnectWise Cloud Backup has a large MSP and enterprise customer base, so the downstream exposure is broad.
What ConnectWise did
ConnectWise shut down affected services once the compromise was confirmed. Restoration is running in phases and was not complete at the time of Microsoft’s disclosure. ConnectWise has not published a standalone incident report.
What to check if you use ConnectWise Cloud Backup
Review OAuth application permissions in your environment and flag any changes made after October 10. Audit directory modifications in that same window, especially new privilege assignments and group membership changes. Rotate credentials on accounts that show high failed-login counts. Pull Microsoft Graph API activity logs and check for unusual calls from ConnectWise application identities.
Do not assume ConnectWise’s service shutdown contained the compromise to their infrastructure. The attack path ran from ConnectWise into customer tenants directly.
Context on Storm-0940
Microsoft first publicly attributed Storm-0940 to China-aligned activity in November 2024, when the group was running password spray campaigns via the Quad7 botnet. This incident is an escalation: an AI framework automated the same credential-spray pipeline, running at speeds a human operator cannot match.
Prior supply chain coverage: Docker Hub’s image impersonation flaw, CrowdSec’s source code theft via TanStack, and git hash chain malleability as a supply chain risk.
Found this useful? Share it.
