Attack method bypassed security measures

The access described by Microsoft did not require user passwords or multifactor authentication. Instead, the attacker used application identities from ConnectWise that had been authorized in their Microsoft 365 environment, or tenant.

Permissions of application identities

Whoever controls these identities has, in each of these tenants, the permissions of the application. A backup tool, for example, requires extended rights to read and restore data, noted Justin Kohler from SpecterOps, as cited by Infosecurity Magazine.

Timing of attacks

In several cases of the campaign conducted since September, less than three hours separated the first targeting from privileged access, according to Microsoft. The company does not specify whether the affected tenants were ConnectWise customers.

Microsoft's attribution

The narrative is based on a Microsoft Security Research and Microsoft Threat Intelligence post, summarized on October 22 in a brief from ActuIA. Microsoft "estimates" that Storm-0940 is responsible for the compromise, without publishing a confidence level.

ConnectWise's response

On October 19, ConnectWise wrote in a notice, cited by Infosecurity Magazine, that it could not "discuss attribution at this stage." On October 21, the company acknowledged Microsoft's findings on its Trust Center notice page, noting that state actors are increasingly targeting the software supply chain.

ARTEX tool used

ARTEX, a post-intrusion accelerator, Microsoft writes that Storm-0940 used ARTEX to accelerate recognition and scanning, password spraying, and abuse of OAuth applications among downstream victims. The post does not say how Storm-0940 obtained the ConnectWise application identities.

ARTEX's capabilities

ARTEX "can use any AI model" and conducts an intrusion test from recognition to exfiltration "with little human interaction," writes Microsoft. The human part in this operation is not specified.

Compromised device network

In a post on October 31, 2024, Microsoft wrote that Storm-0940 exploited identifiers obtained by CovertNetwork-1658, a compromised device network maintained by an actor located in China. In about 80% of cases, this network attempted only one connection per account and per day.

Password spraying campaign

The password spraying conducted from October 10 to 14, 2026, which Microsoft links to Storm-0940's infrastructure, produced more than 151,000 failures against 327 accounts from eight organizations. This averages more than 460 failures per account over five days. Microsoft observed no successful authentication in this.

ARTEX's origin and use

A tool published in July and linked to intrusions in South Korea, ARTEX is a multi-agent system written in Go, published as open source. According to a note from the Cloud Security Alliance, it was uploaded on July 26, 2026 by a developer who signs Autumn-27.

ARTEX's removal and status

On October 8, according to the Cloud Security Alliance, the developer removed the project from GitHub and announced the end of updates and transition to closed code. A project page with code folders remains public on GitHub as of October 22, without a license displayed.

Global use of ARTEX

Microsoft says it has identified malicious actors who use ARTEX "in several regions of the world." It does not name them. ActuIA described on October 20 another campaign, criminal, conducted with AI agents against sites of more than 100 companies.

Storm-0940's targeting

Microsoft writes that Storm-0940 used ARTEX to "try to connect to more than 2,250 tenants," and that the majority of this targeting failed. It does not give any number of compromised tenants.

Successful access not guaranteed

A successful attacker authentication "does not necessarily indicate" access to data or their exfiltration, it specifies. The title of The Register, according to which the ConnectWise breach "let Chinese spies loose on 2,250 cloud tenants," goes beyond the post.

Attack statistics

The figure of 2,900 per minute appears twice in the post. It counts connection attempts for the activity after access to ConnectWise. It also counts failures, for the peak on October 11 of the password spraying conducted from October 10 to 14. This preceded the first public reports, which Microsoft dates to October 15.

Data from Huntress

The field numbers come from Huntress, a security publisher that examined more than 10,000 tenants equipped with ConnectWise applications. It counted 162 tenants with confirmed unauthorized connections on October 16.

Scope of the attack

On October 17, Huntress noted nearly 1,000 tenants targeted from a single IP address, including more than 300 with a successful connection. In about fifty tenants monitored by Huntress, applications assigned themselves directory administrator roles, mainly the Exchange administrator role.

Administrator role compromise

Huntress documents a single case of self-assignment of the general administrator role, which grants all rights on the tenant, by the ConnectWise Cloud Management application for Teams.

ConnectWise's actions

ConnectWise has disabled seven ConnectWise application identities. It first reported on October 16 "attempts" of unauthorized access to the Cloud Backup environment, the former SkyKick. On October 17, the publisher acknowledged unauthorized access to application identities.

Security measures taken

It disabled seven and revoked the certificates of the affected connections. SaaS Security and Cloud Management, integrated into Cloud Backup, were suspended. On October 19, all accounts and identifiers in the affected environment were reset.

Restoration process

The phased restoration began on October 21 and will last "several days." The backup archives remain "encrypted, isolated, and preserved, without indication of compromise," according to ConnectWise.

Microsoft's guidance

The Microsoft post gives instructions that the ConnectWise status page does not contain. Among the immediate measures it recommends: leave the affected ConnectWise connections disabled until formal restoration instructions are given.

Preservation of logs

Do not delete enterprise applications in the first response to preserve configuration and evidence, and retain Microsoft Entra connection and audit logs available. Examine activity since at least October 15, 2026, and when logs exist, extend the review of service principal connections to October 1.

Review of connections

Examine separately successful and failed service principal connections, without limiting to the published IP addresses. Audit the addition of identifiers, new applications, role assignments, and consents.

Evidence preservation

Remove confirmed unauthorized identifiers only after preserving evidence. ConnectWise indicates that already issued access tokens "may remain usable" until their expiration or invalidation.

ConnectWise updates

The company announced two updates per day starting October 22. On October 20, it was still trying to "determine how the unauthorized access first occurred."