Microsoft: China-Aligned Storm-0940 Used ARTEX AI Agents to Compromise ConnectWise Cloud Backup and Hit 2,250+ Microsoft 365 Tenants

ConnectWise Cloud Backup and its downstream managed service provider customers' Microsoft 365 tenants; identity providers (Okta, Entra ID, AWS Cognito) at other IT and software vendors

Microsoft attributed the ConnectWise Cloud Backup supply chain compromise to Storm-0940, which ran ARTEX, a Go-based multi-agent pentest framework, at "machine speed" against hundreds of organizations since September 2026. From October 10-14 the agents password-sprayed 327 accounts at eight organizations, logging over 151,000 failed sign-ins and peaking at 2,900 per minute on October 11. On October 15 they took control of multiple ConnectWise cloud application identities and used them to try more than 2,250 customer tenants, in some cases moving into Microsoft Graph to add app credentials, change groups, and assign privileged roles. In some attacks the time from targeting to privileged cloud access was under three hours. ConnectWise shut services down and restored them in phases. Wiz separately reported the actor running ARTEX against identity providers, abusing password-reset and account-recovery endpoints, and rotating IPs when blocked, in sessions of 24-30 hours

Vendor application identities with standing access to thousands of customer tenants, attacked by an agent framework that adapts and retries without human pacing; added OAuth app credentials persist after the original app is removed