Microsoft assessed that Storm-0940, a hacking group aligned with the Chinese state, used compromised ConnectWise Cloud Backup application credentials to attempt sign-ins at more than 2,250 Microsoft 365 tenants, raising concern about access that could persist after disconnection.
Customers had previously approved the app connections to their Microsoft 365 environments, Microsoft said. In some tenants, it found reconnaissance through Microsoft Graph, attacker-driven application credential changes and efforts to alter privileges.
Microsoft said Storm-0940 attempted sign-ins at more than 2,250 tenants; the figure does not represent confirmed breaches. An app's presence or even a successful login does not by itself show that customer data was accessed or taken. Changes inside a tenant could leave another access route active after the ConnectWise app is turned off. Microsoft said the campaign did not begin with a compromise or vulnerability in its own systems or products.
Microsoft also linked Storm-0940 to ARTEX, an open-source penetration-testing framework that can use AI models. It said the group used it against hundreds of organizations worldwide starting in September 2026; in several attacks, the group gained privileged cloud access within three hours of targeting. Microsoft has also described Storm-0940 using password spraying and exploiting internet-facing applications, and referenced earlier reports involving ARTEX and South Korean financial institutions.
ConnectWise said the service disruption affected its partners and their customers. ConnectWise began restoring services Oct. 21; an Oct. 22 update said phased restoration was underway and could take several days. The company advised partners to wait for formal guidance before reactivating affected app connections. ConnectWise reported no indication that its stored backup archives were compromised, a finding that does not establish whether live customer tenants had unauthorized access. It scheduled its next update for 9 p.m. ET Thursday (01:00 UTC Friday, Oct. 23).
