Microsoft Says China-Aligned Storm-0940 Used SI Tool ARTEX in ConnectWise Supply-Chain Compromise: Hundreds of Organisations Targeted Worldwide
DETROIT / REDMOND — A Chinese-linked hacking group used an SI-driven penetration testing tool to compromise IT services firm ConnectWise as part of a campaign that targeted hundreds of organisations globally, Microsoft said on Wednesday, October 21. The hackers, tracked by Microsoft as Storm-0940, used an open-source penetration testing framework called ARTEX, which allows users to plug in any SI model to automate tasks including reconnaissance and data exfiltration, Reuters reported.
In a threat-intelligence post published the same day, Microsoft described Storm-0940 as a "China-state aligned actor" active since 2021 that targets organisations for data theft, historically gaining initial access through password spraying and exploitation of internet-facing applications. As early as September 2026, Microsoft said, the actor used the agentic SI framework ARTEX to automate attacks targeting hundreds of organisations worldwide across sectors including aerospace and defence, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits. In several cases the actor obtained privileged access to an organisation's cloud infrastructure, multiple times in less than three hours from initial targeting; while the majority of the targeting was not successful, Microsoft said the actor achieved privileged cloud persistence at many organisations in a brief time.
ConnectWise publicly reported on October 16 that its customers' tenants had been accessed without authorisation using multiple OAuth application identities, in an incident involving the ConnectWise Cloud Backup environment. Microsoft assessed that Storm-0940 was responsible for the ConnectWise supply-chain compromise: after acquiring control of multiple ConnectWise cloud application identities, the actor used ARTEX to reach more than 2,250 tenants at 2,900 sign-in attempts per minute. Between October 10 and 14, the actor's infrastructure had also run an automated password-spray campaign against 327 Microsoft 365 and Exchange Online accounts across eight organisations, generating more than 151,000 failed logons, with more than 111,000 concentrated in a single day and no successful authentication observed in that campaign, Microsoft said.
Microsoft said that in some affected environments the actor progressed to Microsoft Graph and directory operations, including reconnaissance, application credential modifications and changes involving identities, groups and privileged roles, but stressed that the presence of an affected application, or even successful authentication, does not necessarily indicate that customer data was accessed or exfiltrated. ConnectWise said in an October 16 statement on its website that it was "investigating recent attempts of unauthorized access associated with the ConnectWise Cloud Backup environment." ConnectWise did not immediately respond to a Reuters request for comment on Microsoft's conclusions, and the Chinese Embassy in Washington did not immediately respond to a request for comment; Beijing regularly denies conducting or condoning cyber-enabled data theft.
Published by GSM · USA (original Chinese edition)
Photo: 图：微软雷德蒙德园区92号楼（资料图）。Coolcaesar 摄，CC BY-SA 4.0，取自维基共享资源。Photo: Building 92 at Microsoft's Redmond campus (file photo). By Coolcaesar, CC BY-SA 4.0, via Wikimedia Commons.
