--- title: Microsoft says ConnectWise breach let Chinese spies... description: Microsoft says China-linked hackers tracked as Storm-0940 used compromised ConnectWise application credentials and an AI penetration-testing tool called ARTEX... canonical: https://daily.dev/posts/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2-250-cloud-tenants-f19cfzlbr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants | daily.dev og:description: Microsoft says China-linked hackers tracked as Storm-0940 used compromised ConnectWise application credentials and an AI penetration-testing tool called ARTEX... og:url: https://daily.dev/posts/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2-250-cloud-tenants-f19cfzlbr og:image: https://api.daily.dev/og/posts/F19cfZlBR.png og:image:alt: Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants **[The Register](https://daily.dev/sources/theregister)** · 4 min read · 0 upvotes · 0 comments ## Summary Microsoft says China-linked hackers tracked as Storm-0940 used compromised ConnectWise application credentials and an AI penetration-testing tool called ARTEX to target over 2,250 Microsoft 365 tenants. In some cases attackers went from targeting to privileged cloud access in under three hours. Between October 10 and 14 they made over 151,000 failed sign-in attempts against 327 accounts at eight organizations before shifting to the stolen ConnectWise credentials, at times hitting 2,900 authentication attempts a minute. Microsoft hasn't disclosed how many customers were actually compromised or whether data was stolen. ARTEX is open source and written in Go, and Microsoft says other attackers have used it too. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is ARTEX and how was it used in the ConnectWise breach attacks? ARTEX is an open source, Go-written AI penetration-testing framework that automates reconnaissance, vulnerability discovery, credential attacks, and data theft. The China-linked group Storm-0940 used it to target over 2,250 Microsoft 365 tenants via stolen ConnectWise application credentials, at times making 2,900 authentication attempts per minute and reaching privileged cloud access in under three hours. _Teams hardening cloud identity against AI-automated attacks can track incidents like this one on daily.dev._ ### How many Microsoft 365 tenants were targeted in the Storm-0940 ConnectWise attack? Microsoft says Storm-0940 attempted to authenticate against more than 2,250 Microsoft 365 tenants using compromised ConnectWise application credentials. The group first ran a password-spraying campaign between October 10 and 14 with over 151,000 failed sign-in attempts against 327 accounts at eight organizations, then pivoted to the stolen ConnectWise credentials for broader access. _Anyone assessing third-party app risk in Microsoft 365 can follow incident details like these on daily.dev._ ### Who is behind the ConnectWise application credential breach disclosed in October 2026? Microsoft attributes the breach to Storm-0940, a China-linked espionage group active since at least 2021 that traditionally relies on password spraying and exploiting internet-facing applications. ConnectWise had not initially identified the attacker before Microsoft's disclosure, and the company pulled its Cloud Backup, SaaS Security, and Cloud Management services after finding unauthorized access to application identities. _Security teams tracking nation-state attribution on vendor breaches can follow updates like this on daily.dev._ ## Similar posts on daily.dev - [Hackers target Microsoft 365 accounts with 81 million login attempts](https://daily.dev/posts/hackers-target-microsoft-365-accounts-with-81-million-login-attempts-tnrut3eab) · BleepingComputer · 0 upvotes · 0 comments - [Microsoft 365 users fall victim to one-in-a-million password spray attack](https://daily.dev/posts/microsoft-365-users-fall-victim-to-one-in-a-million-password-spray-attack-rzc1b0v9d) · CSO Online · 0 upvotes · 0 comments - [China-Linked APT31 Launches Stealthy Cyberattacks on Russian IT Using Cloud Services](https://daily.dev/posts/china-linked-apt31-launches-stealthy-cyberattacks-on-russian-it-using-cloud-services-wjwetdt1t) · The Hacker News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#ai-agents](https://daily.dev/tags/ai-agents), [#microsoft](https://daily.dev/tags/microsoft) [View this post on daily.dev](https://daily.dev/posts/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2-250-cloud-tenants-f19cfzlbr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants","url":"https://daily.dev/posts/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2-250-cloud-tenants-f19cfzlbr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2-250-cloud-tenants-f19cfzlbr"},"datePublished":"2026-10-22T11:30:48.545Z","dateModified":"2026-10-22T17:09:03.054Z","description":"Microsoft says China-linked hackers tracked as Storm-0940 used compromised ConnectWise application credentials and an AI penetration-testing tool called ARTEX...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6f949d934837857cc83019cb5be40cfc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6f949d934837857cc83019cb5be40cfc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2-250-cloud-tenants-f19cfzlbr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,ai-agents,microsoft","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2-250-cloud-tenants-f19cfzlbr#faq","mainEntity":[{"@type":"Question","name":"What is ARTEX and how was it used in the ConnectWise breach attacks?","acceptedAnswer":{"@type":"Answer","text":"ARTEX is an open source, Go-written AI penetration-testing framework that automates reconnaissance, vulnerability discovery, credential attacks, and data theft. The China-linked group Storm-0940 used it to target over 2,250 Microsoft 365 tenants via stolen ConnectWise application credentials, at times making 2,900 authentication attempts per minute and reaching privileged cloud access in under three hours. Teams hardening cloud identity against AI-automated attacks can track incidents like this one on daily.dev."}},{"@type":"Question","name":"How many Microsoft 365 tenants were targeted in the Storm-0940 ConnectWise attack?","acceptedAnswer":{"@type":"Answer","text":"Microsoft says Storm-0940 attempted to authenticate against more than 2,250 Microsoft 365 tenants using compromised ConnectWise application credentials. The group first ran a password-spraying campaign between October 10 and 14 with over 151,000 failed sign-in attempts against 327 accounts at eight organizations, then pivoted to the stolen ConnectWise credentials for broader access. Anyone assessing third-party app risk in Microsoft 365 can follow incident details like these on daily.dev."}},{"@type":"Question","name":"Who is behind the ConnectWise application credential breach disclosed in October 2026?","acceptedAnswer":{"@type":"Answer","text":"Microsoft attributes the breach to Storm-0940, a China-linked espionage group active since at least 2021 that traditionally relies on password spraying and exploiting internet-facing applications. ConnectWise had not initially identified the attacker before Microsoft's disclosure, and the company pulled its Cloud Backup, SaaS Security, and Cloud Management services after finding unauthorized access to application identities. Security teams tracking nation-state attribution on vendor breaches can follow updates like this on daily.dev."}}]} ```