On 21 October 2026, Microsoft said that Storm-0940, an actor it assesses is China-state aligned, used the open-source agentic AI penetration testing framework ARTEX to compromise ConnectWise’s Cloud Backup service and then attempt sign-ins to more than 2,250 customer tenants. ConnectWise, the vendor, opened its incident timeline on 16 October 2026, identified unauthorized access to application identities the next day, and says it found no indication that partner backup data was accessed. The attribution is Microsoft’s assessment, and neither Microsoft nor ConnectWise claims customer data was read or copied.
What Microsoft assessed
Microsoft’s write-up of the campaign describes Storm-0940 as a China-state aligned actor active since 2021. Its historical tradecraft, as Microsoft describes it, has been to gain initial access through password spraying and exploitation of internet-facing applications, then to establish persistence by adding credentials to existing OAuth applications, which the actor has used to reach email and other data through Microsoft Graph. The company assesses that Storm-0940 was responsible for the ConnectWise compromise — a vendor attribution, separate from the telemetry facts.
Microsoft says that as early as September 2026, Storm-0940 was using ARTEX to automate attacks against hundreds of organizations across 14 sectors including financial services, government, manufacturing and semiconductor. In several, Microsoft says, the time from initial targeting to privileged access to an organization’s cloud infrastructure was less than three hours.
The ConnectWise vector was trust rather than exploitation. Cloud Backup, formerly known as SkyKick, places trusted application registrations inside customers’ Microsoft 365 tenants. According to Microsoft, once the actor controlled multiple ConnectWise application identities, its agents used the same IP range to authenticate into downstream customer environments with those stolen credentials, “taking advantage of the already established trust by these apps within a tenant.” In some environments, Microsoft writes, the agents progressed beyond authentication into Microsoft Graph and directory operations, including credential modifications to establish persistence and changes to identities, groups and privileged roles. Microsoft also rules out one convenient theory — “The activity conducted by the threat actor through the usage of ARTEX framework did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services.”
The mechanics: spray volume, tenant reach, and speed
Microsoft’s telemetry puts numbers on the spray. Between 10 and 14 October 2026, infrastructure the company attributes to Storm-0940 at 144.172.64[.]99 ran an automated cross-tenant password-spray campaign against 327 accounts across eight organizations, targeting access to Microsoft 365 and Exchange Online. Microsoft says telemetry captured more than 151,000 failed logon events, peaking on 11 October at 2,900 failures per minute, with nearly 98% of the activity drawing lockout responses.
The company draws a deliberate line between two phases. The spray produced volume without a way in: “Despite the scale, no successful authentication, token issuance, Graph call, or directory change was observed.” The downstream access came from a different mechanism — the stolen ConnectWise application credentials — not the spray. ConnectWise’s 16 October advisory shared an IP address matching the spray infrastructure exactly.
The reach figure carries the same caution. Microsoft says Storm-0940 used ARTEX “to attempt to sign-in to more than 2,250 tenants,” and describes successful authentication and directory changes in “some of these environments” rather than all.
Why ARTEX matters beyond this incident
ARTEX is neither a Microsoft tool nor a state tool. Microsoft describes it as “an open-source penetration testing framework that can use any AI model to automate a variety of offensive security workflows” — “a multi-agent LLM system written in GO with a Next.js frontend” — capable of running “an autonomous penetration test from reconnaissance through data exfiltration with little needed human interaction.”
Google’s Threat Intelligence Group, writing on 30 October 2026, said ARTEX was developed by a user named Autumn-27 and released on GitHub, and that although “the original repository was taken down by its creator in October 2026 due to widespread threat actor abuse, the framework continues to proliferate globally via community forks.”
Other operators use the same tool differently. CrowdStrike’s 7 October write-up assesses with moderate confidence that an unattributed, Chinese-speaking and financially motivated operator used ARTEX against South Korean financial organizations from late September into early October 2026.
Google’s researchers also offer partial corroboration. The Wiz Research team has tracked a campaign that Google tracks as UNC7228 and that “overlaps with activity tracked by Microsoft as the PRC-nexus actor STORM-0940,” with activity dating back to at least August 2026. That analysis does not mention ConnectWise, so it corroborates the actor and timeline rather than the breach.
What is not established
The clearest limit is data exfiltration. Microsoft states plainly: “The presence of an affected application, or even successful authentication, does not necessarily indicate unauthorized data access or data exfiltration.” ConnectWise said it has “no evidence that these encrypted backup archives have been accessed,” and that its Cloud Backup configuration “does not provide us visibility or access to downstream partner and customer environments,” so it “cannot determine through our investigation alone whether a particular customer’s Microsoft 365 environment experienced unauthorized activity.”
ConnectWise’s Trust Center guidance makes the same point: “A successful sign-in alone does not establish that data was copied. Equally, a clean search cannot rule out activity that was not captured in the available logs.” The vendor asks responders to “treat attempts, successful authentication, configuration changes, and data access as distinct findings.”
What you can check now
The work is tenant-side: the compromised credentials belonged to the vendor’s applications in your environment, not to your users. Microsoft’s checklist:
Inventory by application ID, not by display name. Microsoft asks defenders to “inventory all four application IDs listed in this profile and record the local service-principal Object ID in each tenant.” ConnectWise publishes the seven application identities it disabled on 17 October 2026, including the Cloud Backup client ID
506e08f9-6e9a-4da4-942b-a099a03644aeand the MS Graph client ID0de14c77-b9b0-4137-9360-34878a929827. Older installations may still show SkyKick Cloud Manager names, so ConnectWise warns against matching by name.Check every tenant where the applications were ever installed, including integrations no longer in use.
Review activity from 15 October 2026 onward, and where records survive, extend service-principal sign-in review back to 1 October and investigate earlier failures and volume anomalies. ConnectWise’s guidance starts from 13 October.
Review successful and failed service-principal sign-ins separately, and do not limit the search to published IP addresses.
Preserve evidence before deleting anything. Both Microsoft and ConnectWise warn against removing enterprise applications as the first response. ConnectWise notes Entra retains audit and sign-in records for seven days on Free and 30 days on P1/P2 plans, and expired history cannot be recovered by upgrading.
Keep the affected ConnectWise connections disabled until ConnectWise provides formal restoration instructions.
Restoration is under way but not finished. ConnectWise’s incident page records a full reset of all accounts and credentials on 19 October 2026, phased restoration from 28 October, and, as of 4 November, restoration still under way, with partners required to re-authorize each Microsoft 365 tenant using a new application, ConnectWise Cloud Backup for M365. Re-authorization alone does not confirm that backups are running, so verify that new snapshots complete for each tenant.