ConnectWise Cloud Backup: Storm-0940 (China-linked) used stolen app credentials and AI pentest tool ARTEX to access 2,250+ Microsoft 365 tenants
Severity: critical · Patch status: no-fix-needed · Since 2026-10-16
Microsoft attributed the ConnectWise Cloud Backup supply chain compromise to Storm-0940, a China state-aligned threat actor. Attackers used compromised application credentials tied to the Cloud Backup service and an agentic AI penetration-testing framework, ARTEX, to automate reconnaissance, password spraying, OAuth abuse, and credential changes via Microsoft Graph — attempting sign-ins to more than 2,250 downstream customer tenants at up to 2,900 attempts per minute, achieving privileged cloud persistence at some organizations within three hours. ConnectWise disclosed the incident Oct 16, suspended Cloud Backup and took SaaS Security and Cloud Management offline; restoration is ongoing. Existing backup archives show no indication of compromise. No patch applies; remediation is tenant-level credential review and cleanup.
What to do
- Keep affected ConnectWise application connections disabled until vendor guidance clears them
- Review Microsoft 365 tenants tied to ConnectWise per Microsoft's and ConnectWise's remediation guides; investigate unauthorized application credential changes and privilege modifications that could provide persistence
- Preserve logs and forensic evidence before making changes
- Verify backup coverage during the outage and confirm backup jobs and recovery work before reconnecting
- Review OAuth application grants and rotate credentials that may have been exposed
Sources
All live incidents on Threat Watch
