ConnectWise attack: Microsoft points to Storm-0940 and ARTEX
Microsoft says Storm-0940 is behind the abuse of ConnectWise apps in Microsoft 365, with attacks automated by ARTEX. New technical details and checks to run.
The unauthorised access to Microsoft 365 tenants through ConnectWise cloud applications, which ARX News covered on 17 October, now has a name. According to Microsoft’s analysis, published on 22 October and reported by SecurityWeek and Insicurezza Digitale, the activity is the work of Storm-0940, which automated much of the operation with ARTEX, the open source penetration testing framework built on AI agents. The sources add figures, an earlier password spraying phase and new guidance on what to check in tenants.
Who Storm-0940 is
According to SecurityWeek, citing Microsoft, Storm-0940 is a China-linked actor, active since at least 2021 and known for password spraying and exploiting internet-facing applications against organisations in many sectors. Insicurezza Digitale is more cautious: it notes that “Storm-” designations refer to activity clusters not yet attributed with certainty to a known group, and writes that public sources do not report an explicit state attribution.
Also according to SecurityWeek, Storm-0940 has used ARTEX to automate its attacks since early September 2026, against hundreds of organisations in aerospace, automotive, chemicals, defence, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software and technology, as well as non-profits and think tanks. Earlier reporting by CrowdStrike, Zscaler and Recorded Future had linked this activity to the attacks on South Korean financial institutions covered by ARX News on 8 October; at the time CrowdStrike did not attribute it to a known group. This week Zscaler published a technical analysis of how the actor uses ARTEX: configurations, synchronisation scripts, a Claude Code prompt history and network routing tools.
The attack chain according to Microsoft
- Password spraying at machine speed: with ARTEX the actor accelerated reconnaissance, password spraying and OAuth application abuse. Insicurezza Digitale places this phase between 10 and 14 October: 327 accounts across eight organisations, peaks of around 2,900 attempts per minute and more than 151,000 failed sign-ins recorded by Microsoft. On its own, this phase did not succeed.
- Access with the apps’ identities: Microsoft did, however, observe successful authentication to customer environments using the identities of several ConnectWise cloud applications. Following the unauthorised access, according to Microsoft, Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 tenants. OAuth application abuse has long been part of its toolset; what is new, Microsoft writes, is taking it to “machine speed”.
- Directory operations: in some environments the AI agents, acting for the actor, went beyond authentication to Microsoft Graph and directory operations: reconnaissance, changes to application credentials to establish persistence, and changes to identities, groups and privileged roles.
- Persistence beyond remediation: by changing application credentials, Microsoft warns, the attacker keeps access even after the affected application has been remediated.
According to Insicurezza Digitale, in some cases less than three hours passed between target selection and privileged access. The same outlet reports that Microsoft found no direct evidence of mail or files being read or exfiltrated, but that some reads made through the apps do not appear in standard logs, and that Microsoft’s infrastructure was not compromised. How the credential was obtained is still under investigation.
Insicurezza Digitale also reports that ConnectWise began a gradual restoration of its services on 21 October; the other sources do not mention this.
In our reading, the relevant MITRE ATT&CK techniques are T1110.003 (Password Spraying), T1199 (Trusted Relationship), T1087.004 (Cloud Account Discovery), T1098.001 (Additional Cloud Credentials) and T1098.003 (Additional Cloud Roles). The sources publish no indicators beyond those already known.
A separate campaign: token spraying described by Huntress
On the same day Help Net Security and Infosecurity Magazine reported another Huntress analysis, which the sources do not link to Storm-0940. Between 14 July and 22 September 2026 an attacker replayed, at scale, Microsoft 365 session tokens stolen through AiTM pages, device code phishing and social engineering: 497 successful sign-ins at 79 organisations and more than 200,000 failed attempts, from six addresses in the 193.26.115.0/24 range of a Hamburg hosting provider. To stay in, the attacker registered at least 48 fake computers in Entra ID, named “DESKTOP-” followed by eight hexadecimal characters, replaced victims’ MFA methods in 19 organisations and created mail rules with names such as “.”, “sss” and “iT” to hide messages, including in an attempted payroll fraud. Conditional Access policies blocked 1,052 sign-ins at four organisations.
Impact for European and Italian companies
Energy, chemicals, manufacturing, government, financial and digital services are NIS2 sectors, and many are on Storm-0940’s target list. The technical point is pace: an actor that automates spraying, reconnaissance and directory changes leaves defenders hours, not days. Anyone who ran the checks recommended after the first advisory should go back to the logs with the new information: an earlier phase, operations on groups and identities too, and persistence that survives disabling the ConnectWise apps.
What to do now
- Widen the search window to at least 10 October and look for bursts of failed sign-ins from hosting networks against many accounts.
- Correlate service principal sign-ins with the Graph activity that follows, directory changes and resource access, comparing them with authorised administrative activity, as Microsoft recommends.
- Check groups and identities, not just roles: members added to privileged groups, new users, changes to existing users.
- Do not consider remediation complete once the ConnectWise apps are disabled: review credentials and certificates of every application in the tenant.
- Before re-enabling ConnectWise services, follow the vendor’s instructions and check which application identities become active again.
- Against token spraying: Conditional Access requiring MFA, or blocking, for all users, all cloud apps and all client app types; review devices registered in Entra ID, MFA methods and mail rules; if compromise is suspected, revoke sessions and reset the password.
How ARXDOME helps
ARX Horizon enriches events with threat lists, including the addresses already published for this campaign, and ARX Sentry brings firewall logs, where to look for them, into the SOC pages. The checks in the Microsoft 365 tenant still have to be done in the Entra ID admin center.
Last updated:
