Microsoft links ConnectWise breach to China-linked Storm-0940

Microsoft has attributed the ConnectWise security incident to Storm-0940, a China-linked espionage group. The attackers used ARTEX, a Go-based open source penetration-testing tool whose AI agents automate reconnaissance, vulnerability discovery, credential attacks, and data theft. In some cases, attackers gained privileged cloud access less than three hours after initial targeting. ^[1]

ConnectWise stopped its Cloud Backup, SaaS Security, and Cloud Management offerings after it found unauthorized access to application identities. The vendor did not name a responsible party at the time. Microsoft now says Storm-0940, which has been operating since at least 2021 and has traditionally relied on password spraying and exploiting internet-facing applications, began using ARTEX as early as September. Microsoft says the attackers used ARTEX to target organizations worldwide, including government bodies, defense contractors, banks, manufacturers, and technology firms. ^[1]

From October 10 to 14, Storm-0940 attempted to sign in more than 151,000 times without success across 327 accounts at eight organizations. Microsoft observed no successful sign-ins in that password-spraying campaign. The attackers then shifted to the compromised ConnectWise application identities. Those credentials let the attackers use permissions that customers had previously given to ConnectWise services, so no interactive user login was required. ^[1]

With ARTEX, the attackers tried to authenticate to more than 2,250 Microsoft 365 tenants, hitting rates as high as 2,900 attempts per minute. The company also saw AI-accelerated activity via Microsoft Graph, including reconnaissance, credential changes, and privilege escalation attempts. Such changes could help the attackers keep access after the original credentials are disabled. ^[1]

Most authentication attempts failed, but Microsoft says Storm-0940 still gained persistent privileged access at numerous organizations. Microsoft did not say how many customers were compromised or whether data was stolen, and it cautions that a successful login does not guarantee information was accessed. ^[1]

ConnectWise CEO Manny Rivelo said the company contained the affected application connections and is restoring services gradually. He added that shutting down those connections would not automatically remove attackers who had already gained a foothold inside customer environments. ^[1]

ConnectWise disclosed a separate incident in May 2025, when a sophisticated nation-state actor breached a small number of customers via its ScreenConnect remote access software. The Register reports no evidence linking the two incidents. Storm-0940 is not alone in using ARTEX; Microsoft says attackers from several geographic regions have used the freely available penetration-testing framework. The underlying techniques are not new, but AI let the group work faster, and some intrusions gained privileged cloud access less than three hours after initial targeting. ^[1]