Microsoft assessed that Storm-0940 used compromised ConnectWise Cloud Backup application identities to attempt sign-ins at more than 2,250 Microsoft 365 tenants, showing how trusted software access can be abused.
Microsoft said the activity linked the incident to a wider effort in which Storm-0940 used ARTEX as early as September 2026 to automate attacks against hundreds of organizations. Targets included aerospace and defense, energy, finance, government, manufacturing and technology. ARTEX is an open-source penetration-testing framework that can use any AI model; Microsoft said it can perform tests with little human involvement.
Customers had approved the applications’ permissions in advance, allowing the stolen identities to authenticate without an active user session, Microsoft said. In multiple customer environments, it observed reconnaissance through Microsoft Graph, changes to application credentials and attempts to modify privileges. Several attacks reached privileged cloud access in under three hours, although most of the broader targeting was unsuccessful. Microsoft cautioned that an affected application or successful authentication alone does not show that customer data was accessed or taken.
ConnectWise said it found unauthorized access to Cloud Backup application credentials on Oct. 14 and disabled seven application identities at 07:00 UTC on Oct. 17. It also paused SaaS Security and Cloud Management because those services were integrated with Cloud Backup. The company said its backup archives remained encrypted, isolated and preserved, with no indication they had been compromised. Individual Microsoft 365 environments still needed review.
In an update posted at 9 p.m. ET Thursday (01:00 UTC Friday, Oct. 23), ConnectWise said it expected to complete restoration tests and security validation by the end of the weekend. It tentatively planned to enable partners to restore existing backups early the following week, provided the checks succeeded.
