Microsoft Attributes ConnectWise Attack to Storm-0940, Mentions ARTEX Framework
Microsoft says the Storm-0940 actor used a compromised multitenant ConnectWise application and the ARTEX framework to access Microsoft 365 environments. Huntress confirmed unauthorized sign-ins and permission changes in some tenants.
Storm-0940 ARTEX attack, according to Microsoft’s analysis, has affected hundreds of organizations since September 2026. Microsoft attributes the activity to an actor linked to the Chinese state and says the campaign used the ARTEX agentic penetration-testing framework together with the compromise of a multitenant ConnectWise application. Independent observations by Huntress confirm unauthorized sign-ins using ConnectWise Cloud Backup credentials, followed by permission changes in some Microsoft 365 environments.
Storm-0940 ARTEX attack through a trusted application
According to Microsoft, the abused applications signed in to Microsoft 365 tenants without interactive user sign-in. They then conducted reconnaissance of the environment through Microsoft Graph, changed application credentials and attempted to modify assigned permissions.
Huntress said it observed unauthorized sign-ins using compromised ConnectWise Cloud Backup credentials. In some tenants, it observed the Global Administrator role being assigned to the application itself, as well as new secrets being added to applications. Such actions could give an attacker more persistent access to the environment without requiring a user account or user multifactor authentication.
This is not a described vulnerability in Microsoft products. The risk is the compromise of a trusted third-party application that the organization had already granted permissions within its tenant.
ARTEX and the limits of the available findings
Microsoft says Storm-0940 has used ARTEX against hundreds of organizations since September. The case is a specific example of an agentic AI framework being deployed in offensive activities, but publicly available information does not clarify which individual actions ARTEX performed autonomously and which constituted ordinary attacker-directed automation.
The attribution of the campaign to the Storm-0940 group and its links to the Chinese state is Microsoft’s assessment. It is not a publicly documented finding by a law enforcement authority. The exact number of successful accesses and the full scope of affected organizations also remain unclear.
Neither Microsoft nor Huntress confirmed the exfiltration of customer data. Therefore, an application’s successful sign-in or presence in a tenant alone does not prove that the attacker accessed data.
What Microsoft 365 administrators should check
Microsoft and ConnectWise recommend that customers review, in particular, service principal activity, changes to application credentials and changes to privileged permissions. It is important to preserve available logs and carry out the current credential recovery and rotation steps according to ConnectWise’s instructions.
- Check service principal sign-ins associated with ConnectWise applications.
- Look for additions or changes to client secrets and other application credentials.
- Review the assignment of privileged roles, including Global Administrator.
- Preserve relevant records for further investigation and use ConnectWise remediation procedures.
Further information is expected especially from ConnectWise, including confirmed details about the cause of the compromise, credential rotation and the number of affected tenants. Any confirmation of data access, new indicators of compromise and clarification of the attribution and the ARTEX framework’s role will also be important.
Sources
- Microsoft Security Blog – Microsoft’s attribution of the Storm-0940 activity, description of ARTEX use, the technique used to abuse ConnectWise applications, known observations and recommended defensive steps.
- Huntress – Independent observations of ConnectWise credential abuse, unauthorized sign-ins, privilege changes and continuing uncertainty about data access.
- ConnectWise – Cloud Backup technical investigation and remediation guide – ConnectWise’s official source for customers’ technical investigation and remediation steps.
Verified and updated: 10/22/2026 06:24
