Primary sources: Microsoft Security Blog on Storm-0940, ARTEX and ConnectWise, Oct. 21, 2026, ConnectWise Cloud Backup advisory, last updated Oct. 22, 2026

Microsoft said a China-state-aligned group it tracks as Storm-0940 stole application credentials from ConnectWise's Cloud Backup service and used them to authenticate to customer Microsoft 365 environments without an interactive user sign-in^2,1,4.

ConnectWise, which sells IT management and backup tools to managed service providers, said it identified unauthorized access to those application credentials, associated with Cloud Backup, formerly SkyKick, and has been restoring the service in phases³.

Microsoft's Oct. 21 research post says Storm-0940 used ARTEX, an open-source agentic AI penetration-testing framework, as early as September 2026 to automate attacks against hundreds of organizations, and that it assesses the group was responsible for the recently disclosed ConnectWise supply-chain compromise of a multi-tenant application². The Hacker News said ARTEX is a Go-based framework that was later made closed-source after abuse in attacks on South Korean financial institutions⁴.

TechCrunch, citing Microsoft, reported that the group used the stolen credentials to log into customers' Microsoft-hosted environments as if they were an authorized user, and that AI agents were used to reach about 2,250 organizations at a rate of nearly 3,000 attempted sign-ins per minute¹. The Hacker News, also citing Microsoft, put the ConnectWise-related pace at more than 2,250 tenants and 2,900 sign-in attempts per minute⁴. Those two figures do not appear in the extracted text of Microsoft's Oct. 21 post, which describes attacks targeting hundreds of organizations².

The Hacker News, citing Microsoft, said that between Oct. 10 and Oct. 14, 2026, infrastructure at 144.172.64.99 ran an automated cross-tenant password-spray against 327 accounts at eight organizations, capturing more than 151,000 failed logon events and peaking on Oct. 11, with no successful authentication detected in that window⁴. It said that on Oct. 15 the same IP range was used after AI agents obtained identities of multiple ConnectWise cloud applications and began authenticating to customer environments⁴.

Microsoft said the activity let the actor operate without requiring an interactive user sign-in, and that in multiple affected environments it observed follow-on Microsoft Graph activity, including reconnaissance, application credential changes and attempts to modify privileges². It said several of the ARTEX-driven attacks produced privileged access to an organization's cloud infrastructure, including cases where the time from initial targeting to privileged access was less than three hours². The Hacker News said Microsoft warned that credential changes made by those agents can remain as a backdoor after the original compromised application is mediated⁴.

Microsoft also said that seeing an affected application or a successful authentication does not necessarily mean customer data was accessed or exfiltrated². It said the ARTEX activity did not result from a compromise of Microsoft corporate systems, products or services².

ConnectWise's advisory, originally published Oct. 16 and last updated Thursday, Oct. 22, at 13:00 UTC, said teams and independent specialists were still advancing phased restoration and would share reconnection instructions as they are confirmed³. TechCrunch said as of Thursday the company had paused access to Cloud Backup and was working on restoring it¹. The Hacker News quoted ConnectWise saying the activity describes a campaign that reaches well beyond any one company⁴.

The Hacker News said Microsoft first detailed Storm-0940 in November 2024 in connection with the Quad7 botnet and password-spray activity, and that the actor is assessed to have been active since at least 2021⁴.

A separate ConnectWise advisory on the same Trust Center page concerns an Axcient legacy portal interruption tied to industry-wide PHP flaws; the company said that issue is separate from the Cloud Backup incident³.

Sources

1. TechCrunchChinese hackers spied on thousands of companies after breaching IT giant ConnectWiseOct 22, 12:47 PM
2. Microsoft Security BlogAI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromiseOct 20, 8:00 PM
3. ConnectWiseCloud Backup (formerly known as SkyKick) Service InterruptionOct 22, 9:00 AM
4. The Hacker NewsChina-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain AttackOct 22, 8:00 AM

Read the original at TechCrunch ↗