Threat
Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack
First reported darkreading.com
Page published · Page updated
Earliest dated coverage: 22 Oct 2026 · First observed: 22 Oct 2026 · Latest dated coverage: 22 Oct 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
Storm-0940’s campaign demonstrates how agentic attack automation combined with compromised service credentials can rapidly scale downstream cloud compromises.
Microsoft linked Storm-0940 to a ConnectWise Cloud Backup supply-chain attack that used an agentic AI penetration-testing framework to accelerate operations. Compromised application credentials enabled attempted access to more than 2,250 downstream Microsoft 365 tenants; although most targeting failed, the attackers established privileged cloud persistence at many organizations, sometimes within three hours of initial targeting.
Summary
Dark Reading reports that Microsoft linked a ConnectWise Cloud Backup supply-chain compromise to Storm-0940, a China-linked threat actor. Attackers used compromised application credentials associated with the backup service to attempt access to more than 2,250 downstream Microsoft 365 tenants. That number measures attempted reach, not confirmed victim count: Microsoft reportedly said most targeting failed, while many organizations experienced privileged cloud persistence. Attribution and operational findings in this dossier are supported by the supplied news report, rather than independently supplied Microsoft or ConnectWise source text.[0]
The reported operational accelerator was ARTEX, an agentic AI penetration-testing framework used for reconnaissance and scanning, password spraying, and OAuth application abuse. Sign-in activity reached as many as 2,900 attempts per minute, and attackers obtained privileged cloud access in less than three hours after initial targeting in multiple instances. Microsoft also reportedly observed follow-on Microsoft Graph reconnaissance, application credential changes, and attempted privilege modifications.[0]
ConnectWise disclosed unauthorized access to Cloud Backup application identities on October 16, 2026, then suspended Cloud Backup and took SaaS Security and Cloud Management offline. Its October 22 update kept affected application connections offline while restoration continued. The initial means of compromising the application identities remained publicly unexplained. ConnectWise reported no indication that existing backup archives were compromised, but customers were still directed to investigate their own Microsoft 365 environments before reconnecting.[0]
Attack chain
- Compromised service application identities: The attackers obtained control of application identities associated with ConnectWise Cloud Backup. Those identities supported authorized access to customer Microsoft 365 environments for backup and restoration. The report does not establish how the attackers initially acquired that control.[0]
- Downstream tenant access attempts: Storm-0940 used the compromised application credentials to attempt access to more than 2,250 customer tenants. ARTEX accelerated the operation, with reported sign-in activity reaching as many as 2,900 attempts per minute. The majority of targeting was reportedly unsuccessful.[0]
- Follow-on cloud activity and persistence: In affected environments, Microsoft reportedly observed AI-accelerated activity through Microsoft Graph, including reconnaissance, application credential changes, and attempted privilege modifications. The report describes privileged access within three hours of initial targeting in multiple instances and privileged cloud persistence at many organizations, without providing an exact successful-compromise count.[0]
Disclosure timeline
| Date | Event |
|---|---|
| 2026-10-16 | ConnectWise disclosed unauthorized access to application identities associated with Cloud Backup. The article states that the company subsequently published additional details and containment guidance.[0] |
| 2026-10-22 | ConnectWise reported continued restoration work and instructed customers to keep affected application connections offline until further notice. Investigation and monitoring were continuing, and the company stated that existing backup archives remained encrypted, isolated, and preserved, with no indication of compromise.[0] |
| 2026-10-22 | Dark Reading published its account of Microsoft's Storm-0940 attribution, ARTEX-assisted activity, downstream tenant targeting, and recommended investigation and recovery measures.[0] |
Actor profile
Storm-0940
Microsoft's tracking name for the China-linked actor identified in the supplied reporting. Microsoft reportedly placed the ConnectWise incident within a broader campaign beginning as early as September and targeting hundreds of organizations worldwide, including manufacturing, aerospace, chemicals, energy, defense, and financial services. The actor used ARTEX to automate offensive workflows and abused compromised application credentials for downstream cloud access. The supplied evidence does not establish a more specific organizational affiliation or campaign objective.[0]
How it works
The reported access mechanism was abuse of trusted application identities rather than a described software vulnerability. ConnectWise Cloud Backup requires authorized application access to customer Microsoft 365 environments to perform backup and restoration. Compromise of credentials associated with that service allowed attackers to attempt downstream tenant access through an existing service relationship. The original credential-compromise mechanism was not publicly explained in the report.[0]
After access, reported Microsoft Graph activity included reconnaissance and application credential changes, alongside attempts to modify privileges. These changes could create expanded or persistent access beyond the initially abused connection, which is why the article's response guidance emphasizes investigating unauthorized application changes before reconnection. ARTEX accelerated these operations; the report does not identify a distinct AI-specific vulnerability.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| ConnectWise Cloud Backup and associated Microsoft 365 application connections | Application identities associated with Cloud Backup were accessed without authorization, and their credentials were used to target more than 2,250 downstream Microsoft 365 tenants. No software version range or exact successful-compromise count is supplied. | Cloud Backup was suspended. As of the reported October 22 update, restoration was continuing and affected application connections were to remain offline. No software patch is identified in the supplied report.[0] |
| ConnectWise SaaS Security and Cloud Management | Both services were taken offline following the incident. The supplied report establishes service disruption, not separate confirmed compromises of these products, and provides no affected version ranges. | Services were included in the reported disruption and restoration effort. No product-specific patch or completed restoration status is supplied.[0] |
Key takeaways
- Treat more than 2,250 tenants as the reported targeting scope, not a confirmed breach count. The evidence distinguishes predominantly unsuccessful targeting from successful privileged access and persistence at an unquantified subset of organizations.[0]
- The reported AI contribution was operational acceleration: ARTEX helped scale existing techniques involving application credentials, OAuth abuse, and Microsoft Graph activity. The initial compromise of the ConnectWise application identities remains unexplained.[0]
- Service restoration, tenant remediation, and backup recoverability require separate validation. ConnectWise's statement that existing archives showed no indication of compromise does not resolve whether unauthorized application credentials or privileges remain in a customer tenant.[0]
Defensive actions
- Keep affected ConnectWise application connections disabled in accordance with the reported vendor guidance.: ConnectWise's October 22 update explicitly instructed customers to keep these connections offline while investigation and restoration continued.[0]
- Review every Microsoft 365 tenant that may have been connected to the affected ConnectWise service.: The attackers used service-associated application credentials to target downstream tenants. Microsoft's reported guidance called for reviewing every potentially connected tenant rather than treating only visibly disrupted environments as in scope.[0]
- Preserve sign-in logs, audit records, and other forensic evidence before making changes where possible, without delaying containment.: The article reports Microsoft's recommendation to preserve evidence before changes and quotes incident-response advice to preserve evidence without delaying containment. These records are relevant to reconstructing application access and subsequent changes.[0]
- Investigate application sign-ins, Microsoft Graph activity, newly added credentials, privilege changes, and unusual data access; remove confirmed unauthorized access.: These are the investigation areas explicitly recommended in the article. Reported application credential changes and attempted privilege modifications could leave an additional route into an environment even after the affected connection is disabled.[0]
- Verify vendor remediation and tenant remediation separately before reconnecting, and use controlled validation after containment.: The quoted response guidance distinguishes vendor-side recovery from customer-tenant cleanup. It recommends testing whether comparable application behavior can still reach sensitive resources or establish another foothold.[0]
- Assign customer-side and service-provider owners to check backup coverage during the interruption, then verify backup-job completion and recovery after reconnection.: Suspension of a backup service creates a separate continuity question even when existing archives are preserved. The article specifically recommends explicit ownership for coverage checks and verification that restored connections produce working backups and recovery.[0]
- Exercise a recovery scenario in which the ConnectWise service is unavailable, including identifying tenant-connected applications and practicing how to sever their connections.: The incident interrupted a service organizations normally depend on for recovery. The article recommends planning for that dependency loss with the service provider and establishing who decides whether the business can tolerate the interruption.[0]