Microsoft has named Storm-0940, a China-state actor it has tracked since at least 2021, as the crew behind the ConnectWise Cloud Backup compromise. What separates this intrusion from the group’s earlier work is the toolkit.
The actor leaned on ARTEX, an open-source Go framework that hands reconnaissance, vulnerability discovery, password spraying and credential attacks to AI agents. Microsoft says the group was running it at machine speed, and that some victims went from first targeting to privileged cloud access in under three hours.
What the sign-in logs showed
Between October 10 and 14, more than 151,000 failed sign-ins hit 327 accounts at eight organizations. None appear to have worked. The crew then switched to application identities it had taken from ConnectWise, which customers had already trusted inside their tenants.
That shift is the dangerous part. Requests minted through a consented app need no interactive login, so authentication logs record a legitimate service rather than a person. Microsoft counted nearly 2,900 attempts a minute against more than 2,250 Microsoft 365 tenants. Graph activity that followed included directory reconnaissance, credential changes on apps and privilege edits that could outlast the revocation.
Most tries failed. Some did not: Microsoft says the actor established persistent privileged access at a number of organizations, without saying how many or whether data left.
The gap revocation does not close
ConnectWise CEO Manny Rivelo said affected connections are contained and services are coming back. Cutting an app link stops new tokens; it does nothing about a credential the intruder already planted inside a customer directory.
Defenders should hunt for service principal credential additions around October 15, and for Graph enumeration from unusual hosting IPs. Treat every ConnectWise-granted permission as a live attack path until reviewed. Microsoft notes other regional actors are already using ARTEX, which stays freely available.
