Microsoft Links ConnectWise Attack to China’s Storm-0940 Using AI Framework

• •Storm-0940, a China-state aligned actor, targeted ConnectWise customers using ARTEX.
• •The attack involved over 151,000 failed logon attempts across eight organizations.
• •Storm-0940 achieved privileged access in under three hours in some cases.

Microsoft has attributed a recent supply-chain attack targeting ConnectWise customers to a China-state aligned threat actor known as Storm-0940. The group utilized the ARTEX AI penetration testing framework to automate attacks against hundreds of organizations globally, including sectors like aerospace, defense, and finance. The attack began in September 2026, with Storm-0940 conducting a password-spraying campaign that resulted in over 151,000 failed logon attempts across eight organizations. Following this, the actor compromised ConnectWise’s Cloud Backup service, gaining unauthorized access to Microsoft 365 environments. Microsoft observed that the AI-driven attacks allowed for rapid escalation to privileged access, often within three hours of initial targeting. The company has not disclosed the exact number of affected customers but noted that successful authentication does not confirm data theft. The use of ARTEX enabled Storm-0940 to operate at a pace that challenges defenders' detection capabilities. Microsoft has indicated that multiple threat actors are adopting ARTEX to enhance their attack strategies.