--- title: Microsoft Links Storm-0940 to ConnectWise Supply Chain... description: Microsoft has linked China-nexus actor Storm-0940 to a supply chain attack on ConnectWise Cloud Backup. The attackers used compromised application credentials... canonical: https://daily.dev/posts/microsoft-links-storm-0940-to-connectwise-supply-chain-attack-udattnmm4 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack | daily.dev og:description: Microsoft has linked China-nexus actor Storm-0940 to a supply chain attack on ConnectWise Cloud Backup. The attackers used compromised application credentials... og:url: https://daily.dev/posts/microsoft-links-storm-0940-to-connectwise-supply-chain-attack-udattnmm4 og:image: https://api.daily.dev/og/posts/udAtTNMm4.png og:image:alt: Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary Microsoft has linked China-nexus actor Storm-0940 to a supply chain attack on ConnectWise Cloud Backup. The attackers used compromised application credentials to target over 2,250 downstream Microsoft 365 tenants, gaining privileged cloud access at some organizations in under three hours. Storm-0940 used an agentic AI penetration-testing framework called ARTEX to automate reconnaissance, password spraying, and OAuth abuse, generating up to 2,900 sign-in attempts per minute. ConnectWise disclosed unauthorized access to application identities on Oct. 16 and has suspended its Cloud Backup service and taken SaaS Security and Cloud Management services offline, while investigation and restoration continue. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is ARTEX and how was it used in the ConnectWise supply chain attack? ARTEX is an agentic AI penetration-testing framework used by the China-linked threat actor Storm-0940 to automate and accelerate reconnaissance, password spraying, and OAuth application abuse. In the ConnectWise Cloud Backup incident, Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 Microsoft 365 tenants, generating up to 2,900 sign-in attempts per minute, gaining privileged access at some organizations in under three hours. _Teams tracking AI-driven attack tooling can follow incidents like this one on daily.dev._ ### How many organizations were affected by the ConnectWise Cloud Backup breach? Storm-0940 attempted to access the Microsoft 365 environments of more than 2,250 downstream ConnectWise customer tenants using compromised application credentials tied to ConnectWise Cloud Backup. ConnectWise disclosed the unauthorized access on October 16 and subsequently suspended its Cloud Backup, SaaS Security, and Cloud Management services while investigating and restoring them. _Anyone assessing exposure from a vendor's backend can track updates on breaches like this via daily.dev._ ### What should organizations do after a supply chain compromise like the ConnectWise Cloud Backup incident before reconnecting affected services? Organizations should keep affected connections disabled per vendor guidance, investigate for unauthorized application credential changes or privilege modifications that could provide renewed access, and preserve logs and forensic evidence without delaying containment, according to Ross Filipek of Corsica Technologies. They should also verify backup jobs are completing and recovery works before considering the connection restored. _Incident responders planning a safe reconnection can keep up with guidance like this on daily.dev._ ## Similar posts on daily.dev - [Microsoft Self-Service Password Reset abused in Azure data theft attacks](https://daily.dev/posts/microsoft-self-service-password-reset-abused-in-azure-data-theft-attacks-wzksyvp0l) · BleepingComputer · 0 upvotes · 0 comments - [China-Linked APT31 Launches Stealthy Cyberattacks on Russian IT Using Cloud Services](https://daily.dev/posts/china-linked-apt31-launches-stealthy-cyberattacks-on-russian-it-using-cloud-services-wjwetdt1t) · The Hacker News · 0 upvotes · 0 comments - [Microsoft 365 users fall victim to one-in-a-million password spray attack](https://daily.dev/posts/microsoft-365-users-fall-victim-to-one-in-a-million-password-spray-attack-rzc1b0v9d) · CSO Online · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#microsoft](https://daily.dev/tags/microsoft), [#agentic-ai](https://daily.dev/tags/agentic-ai), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/microsoft-links-storm-0940-to-connectwise-supply-chain-attack-udattnmm4) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack","url":"https://daily.dev/posts/microsoft-links-storm-0940-to-connectwise-supply-chain-attack-udattnmm4","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/microsoft-links-storm-0940-to-connectwise-supply-chain-attack-udattnmm4"},"datePublished":"2026-10-22T22:06:58.034Z","dateModified":"2026-10-22T22:08:53.620Z","description":"Microsoft has linked China-nexus actor Storm-0940 to a supply chain attack on ConnectWise Cloud Backup. The attackers used compromised application credentials...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b612d660f1559c7065295b9943edfea1?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b612d660f1559c7065295b9943edfea1?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/microsoft-links-storm-0940-to-connectwise-supply-chain-attack-udattnmm4","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,microsoft,agentic-ai,oauth","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/microsoft-links-storm-0940-to-connectwise-supply-chain-attack-udattnmm4#faq","mainEntity":[{"@type":"Question","name":"What is ARTEX and how was it used in the ConnectWise supply chain attack?","acceptedAnswer":{"@type":"Answer","text":"ARTEX is an agentic AI penetration-testing framework used by the China-linked threat actor Storm-0940 to automate and accelerate reconnaissance, password spraying, and OAuth application abuse. In the ConnectWise Cloud Backup incident, Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 Microsoft 365 tenants, generating up to 2,900 sign-in attempts per minute, gaining privileged access at some organizations in under three hours. Teams tracking AI-driven attack tooling can follow incidents like this one on daily.dev."}},{"@type":"Question","name":"How many organizations were affected by the ConnectWise Cloud Backup breach?","acceptedAnswer":{"@type":"Answer","text":"Storm-0940 attempted to access the Microsoft 365 environments of more than 2,250 downstream ConnectWise customer tenants using compromised application credentials tied to ConnectWise Cloud Backup. ConnectWise disclosed the unauthorized access on October 16 and subsequently suspended its Cloud Backup, SaaS Security, and Cloud Management services while investigating and restoring them. Anyone assessing exposure from a vendor's backend can track updates on breaches like this via daily.dev."}},{"@type":"Question","name":"What should organizations do after a supply chain compromise like the ConnectWise Cloud Backup incident before reconnecting affected services?","acceptedAnswer":{"@type":"Answer","text":"Organizations should keep affected connections disabled per vendor guidance, investigate for unauthorized application credential changes or privilege modifications that could provide renewed access, and preserve logs and forensic evidence without delaying containment, according to Ross Filipek of Corsica Technologies. They should also verify backup jobs are completing and recovery works before considering the connection restored. Incident responders planning a safe reconnection can keep up with guidance like this on daily.dev."}}]} ```