Storm-0940 uses AI to target hundreds of organizations via ConnectWise breach

Storm-0940 ConnectWise ARTEX supply chain attack AI-driven cyberattacks

Microsoft has identified a large-scale cyberattack campaign conducted by Storm-0940, a threat actor aligned with the Chinese state. The group has been utilizing ARTEX, an open-source AI-driven penetration testing framework, to automate attacks against hundreds of organizations globally since September 2026.

The campaign involved a supply chain breach of ConnectWise Cloud Backup. Attackers exploited stolen application credentials to access customer Microsoft 365 environments, bypassing the need for individual user sign-ins. Microsoft reported that the attackers targeted more than 2,250 tenants, with login attempts peaking at 2,900 per minute.

The use of AI agents allowed the group to operate at machine speed, with several instances where attackers gained privileged cloud access in less than three hours. Targeted sectors include aerospace, defense, energy, finance, government, and semiconductors. While Microsoft stated its own systems were not exploited, it advised organizations to review audit logs and monitor for unauthorized credential or privilege changes.

Entities

ARTEX · China · ConnectWise · Microsoft · Microsoft Entra ID · Storm-0940

Claims

What the coverage asserts, and how many sources carry each claim.

[● 2 SOURCES] ConnectWise reported that existing backup archives remain encrypted and isolated. fernandoplaceres.com · www.it-daily.net
[○ 1 SOURCE] Attackers used stolen application identities to access Microsoft 365 environments via Microsoft Entra ID. www.it-daily.net
[○ 1 SOURCE] ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services. www.it-daily.net
[● 3 SOURCES] The attackers used an AI-powered penetration testing framework called ARTEX. fernandoplaceres.com · rayhaber.com · www.donanimhaber.com
[● 7 SOURCES] Privileged access was obtained in less than three hours in some cases. fernandoplaceres.com · rayhaber.com · www.itmedia.co.jp · complexdiscovery.com · securityaffairs.com · +2 more
[● 10 SOURCES] Microsoft attributes the attack on ConnectWise Cloud Backup to the group Storm-0940. fernandoplaceres.com · rayhaber.com · tedroid.com · www.itmedia.co.jp · complexdiscovery.com · +5 more
[● 14 SOURCES] The attack involved a supply chain breach of ConnectWise Cloud Backup. fernandoplaceres.com · www.donanimhaber.com · tedroid.com · www.itmedia.co.jp · complexdiscovery.com · +9 more
[● 13 SOURCES] Storm-0940 is considered to be aligned with the Chinese state. fernandoplaceres.com · rayhaber.com · www.donanimhaber.com · tedroid.com · www.itmedia.co.jp · +8 more
[○ 1 SOURCE] ARTEX has been used in personal information leaks targeting South Korean financial institutions. www.itmedia.co.jp
[● 3 SOURCES] Microsoft stated its own systems and products were not exploited in these attacks. www.itmedia.co.jp · fernandoplaceres.com · tinhte.vn
[● 7 SOURCES] ARTEX can automate tasks from reconnaissance to data exfiltration using AI models. www.itmedia.co.jp · tedroid.com · www.donanimhaber.com · townhall.com · borncity.com · +2 more
[○ 1 SOURCE] GMO Cybersecurity by Yeru confirmed ARTEX was used in attacks against approximately 20 Japanese companies. www.itmedia.co.jp