Microsoft ties ConnectWise cloud app compromise to China-aligned Storm-0940

Microsoft said on October 21 that Storm-0940, a China state-aligned threat actor, was behind the recent compromise of ConnectWise's multi-tenant cloud backup application, and that the group used ARTEX, an agentic AI penetration testing framework, to automate attacks on hundreds of organizations starting around September 2026. According to Microsoft, several intrusions gave the actor privileged access to cloud infrastructure in less than three hours from initial targeting.

What happened

Microsoft says Storm-0940 has been active since at least 2021. Between October 10 and 14, the group ran a password-spray campaign from 144.172.64.99 against 327 accounts at eight organizations, generating more than 151,000 failed logons with a peak of 2,900 failures per minute on October 11. Microsoft observed no successful authentication in that phase.

On October 15, public reports of the ConnectWise cloud backup compromise emerged with indicators in the same 144.172.64.x range, and ConnectWise published its initial advisory on October 16. Microsoft stressed that the activity "did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services." The Hacker News reported that ConnectWise temporarily shut down services and is restoring them in phases.

Technical details

After gaining control of identities for several ConnectWise cloud applications, the attackers' agents used the stolen app credentials to authenticate into customer tenants, abusing the trust those apps already held. No interactive user sign-in was required. Microsoft says the actor attempted sign-ins to more than 2,250 tenants at about 2,900 attempts per minute.

In some environments the activity continued into Microsoft Graph and directory operations: reconnaissance, adding application credentials for persistence, and changes to identities, groups and privileged roles. In one case, a ConnectWise management application self-assigned the Global Administrator role. Microsoft warns that persistence added through application credentials can remain as a backdoor even after the compromised app is fixed, but that an affected application does not necessarily mean data was accessed.

According to The Hacker News, Zscaler found a custom ARTEX deployment that used DeepSeek through an OpenAI-compatible gateway, with prompts seeking personal and transaction data and payment API keys, which suggests a financial motive. Targeted sectors include aerospace and defense, energy, financial services, government, manufacturing, semiconductors and software.

What to do

Microsoft recommends that ConnectWise customers keep the affected application connections disabled until ConnectWise issues formal restoration instructions, and not delete enterprise applications as a first step so that evidence is preserved. Administrators should search every Microsoft 365 tenant by application ID, preserve Entra sign-in and audit logs, and review activity from at least October 15, extending service-principal sign-in review back to October 1 where possible.

Reviews should cover credential additions to apps, new service principals or owners, consent grants, privileged role assignments, Conditional Access changes, and unusual mail forwarding or inbox rules. Microsoft lists 144.172.64.128, 144.172.64.99 and 144.172.64.60 among the indicators, along with user agents such as python-requests/2.31.0 and azure-toolkit/1.0, but advises not to limit hunting to published IPs.