25 OCT 2026 — Microsoft says the group behind last week's break-in at ConnectWise's Cloud Backup service is a state-aligned Chinese actor that ran much of the operation through an open-source AI hacking framework. In a research post published on 21 October, Microsoft named the group Storm-0940 and the tool ARTEX, and said it had seen several cases where the attackers went from first targeting an organisation to privileged cloud access in less than three hours.
ConnectWise accepted the finding the same day. "Based on the evidence available to ConnectWise, including threat intelligence shared by Microsoft, it appears that a China state-aligned group was responsible for the attack on ConnectWise Cloud Backup," the company said in an update to its Trust Center advisory.
What Microsoft is claiming
Microsoft describes Storm-0940 as "a China-state aligned actor" with no known aliases at other security firms, active since 2021 and focused on data theft. The group typically password-sprays, exploits internet-facing applications, and, in cloud environments, adds credentials to OAuth applications that already have access to a victim's Microsoft 365 data.
The company's wording on the ConnectWise link is an assessment rather than a finding of fact: "Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application." The post sets out infrastructure and timing evidence for that view but does not say how many customers were compromised. It also says the activity did not come from any compromise of, or flaw in, Microsoft's own systems.
Microsoft says the same group has used ARTEX since as early as September against hundreds of organisations in sectors including aerospace and defence, energy, financial services, government, semiconductors and think tanks. Most of that targeting failed, it says, though the group still gained persistent privileged access at many organisations within a short time.
A password spray, then the backup app
The timeline starts before ConnectWise knew anything was wrong. Between 10 and 14 October, according to Microsoft, an address at 144.172.64.99 sprayed passwords at 327 accounts in eight organisations. Microsoft counted more than 151,000 failed logons, peaking on 11 October at 2,900 a minute, and no successful sign-in.
On 15 October the same address range turned up in reports of the ConnectWise compromise. ConnectWise's first status notice, posted at 17:48 UTC on 16 October, listed 144.172.64.128 as the suspicious source. Microsoft says a later ConnectWise indicator matched the spraying address exactly.
With the identities of several ConnectWise cloud applications in hand, the attackers could sign in to customers' Microsoft 365 tenants as those trusted apps, no interactive user sign-in required. Microsoft says the group used ARTEX to attempt sign-ins to more than 2,250 tenants. In some, the agents went on to reconnaissance through Microsoft Graph, changed application credentials and altered identities, groups and privileged roles.
What ARTEX does
ARTEX is an open-source penetration-testing framework. Microsoft describes it as a set of agents, driven by large language models, that can work through a test from reconnaissance to data exfiltration with little human input, recording the assets and weaknesses they find as a graph. It can run on any AI model. Its interface defaults to English, with Korean, Mandarin, Spanish and Japanese as alternatives.
The tool was already known. RECATOOLS reported on 12 October that CrowdStrike had found ARTEX on servers used in data thefts from South Korean banks. Microsoft refers to those breaches only as public reporting and does not say Storm-0940 carried them out. It does say it has seen threat actors in several regions using the framework.
OAuth abuse is already routine for Storm-0940, Microsoft says. ARTEX changed the pace, letting the group "accelerate the activity to machine speed". Agents do not sleep, and they can try several routes at once. The sign-in flood does trip alerts, Microsoft notes, but defenders have very little time to respond and remove the attackers' access cleanly.
What has not been established
Microsoft cautions that finding the affected application in a tenant, or even a successful sign-in by the attackers, "does not necessarily indicate that customer data was accessed or exfiltrated". ConnectWise says its existing backup archives "remain encrypted, isolated and preserved, with no indication of compromise", and that it has no sign that its other products are affected. It has also said, from its first updates, that Cloud Backup gives it no view into customers' own tenants, so it cannot tell partners whether their environments were touched.
Neither company has published the evidence behind the national attribution beyond infrastructure and behaviour. Microsoft frames its conclusion as an assessment, and ConnectWise says only that it "appears" a China state-aligned group was responsible. SecurityWeek reported the findings on 23 October.
Restoration and what admins should check
ConnectWise cut off Cloud Backup application access on 17 October, halting customer backups. Its 24 October update says restoration testing and security checks would run through the weekend, with phased partner onboarding set to start Monday 26 October if those checks pass. Restores from existing backups would come first, followed by full re-enrolment.
Keep the affected ConnectWise app connections disabled until ConnectWise issues restoration instructions. "Do not delete enterprise applications as the first response," it advises; configuration and evidence should be preserved before anything irreversible is done. Search for the apps by application ID rather than display name, review service-principal sign-ins from at least 15 October (back to 1 October where logs allow), and look for added credentials, new owners, consent grants and privileged role assignments. CyberScoop's account of the post also observes that Microsoft gave no count of compromised customers.
Our earlier report covers the first week of the incident, including Huntress's tenant counts.
View author profile → · Editorial policy
