What should Microsoft 365 admins do about the ConnectWise compromise?

Microsoft advises keeping ConnectWise application connections disabled until ConnectWise gives restoration steps, preserving Entra sign-in and audit logs before deleting anything, and reviewing activity from at least October 15, 2026. Admins should look for credential additions, new app owners, consent grants and privileged role assignments, then remove and rotate any unauthorized credentials found.

Does Microsoft Defender detect the Storm-0940 ARTEX activity?

Microsoft lists detections across Defender XDR, Defender for Cloud Apps and Defender for Cloud for Key Vault. Named alerts include an application self-assigning the Global Administrator role, unusual Microsoft Graph activity tied to the compromised ConnectWise application, and suspicious app role assignments to a service principal. Microsoft also recommends turning on threat protection for AI services in Defender for Cloud.

Is ARTEX still open source after the Storm-0940 attacks?

ARTEX was released on GitHub earlier in 2026 by an account called Autumn-27, according to The Record. Its developer said the tool was misused, will no longer be updated and will move to closed source. ARTEX has also been linked to attacks on South Korean and Japanese financial institutions, and Microsoft says attackers from several regions have used it.

Were the Storm-0940 attacks on ConnectWise customers successful?

Microsoft says most of the Storm-0940 targeting failed, and the October 10–14 password spray against 327 accounts produced no successful sign-in. The later attacks through ConnectWise application identities did reach privileged cloud access at several organizations. Microsoft has not said how many customers were compromised or whether data was stolen.

Microsoft Threat Intelligence · 2026-10-21 · major

Storm-0940 used ARTEX AI agents — ConnectWise hack hit 2,250+ tenants

Microsoft says China-aligned group Storm-0940 used ARTEX, an open-source AI pen-testing framework, to automate a ConnectWise supply-chain attack that tried to sign in to more than 2,250 Microsoft 365 tenants.

Microsoft Security blog banner for a threat intelligence report on a Storm threat actor

A state-aligned hacking group used an open-source AI agent framework to move from target to cloud admin in under three hours.

Quick facts

Actor	Storm-0940 (China-state aligned, per Microsoft)
Tool	ARTEX, open-source AI pen-testing framework (Go)
Entry point	Compromised ConnectWise multi-tenant app credentials
Scale	Sign-in attempts against 2,250+ tenants
Peak rate	2,900 failed sign-ins per minute (Oct 11)
Fastest compromise	Under 3 hours to privileged access
Activity since	As early as September 2026

What is it?

Microsoft Threat Intelligence published a report on October 21, 2026 that ties the ConnectWise supply-chain compromise to Storm-0940, a China-state aligned actor. The group used ARTEX, an open-source penetration-testing framework that can use any AI model, to automate scanning, password spraying and OAuth app abuse against hundreds of organizations since as early as September 2026.

How does it work?

ARTEX is a multi-agent LLM system written in Go with a Next.js frontend that can run a full pen test, from reconnaissance to data exfiltration. After password spraying against 327 accounts produced no successful logins, Storm-0940 switched to stolen ConnectWise application identities. Those let it sign in as the app, use permissions customers had already granted, read Key Vault secrets in bulk, and in one case make the app assign itself Global Administrator.

Why does it matter?

The case shows AI agents turning a single stolen app credential into attacks at machine speed: up to 2,900 sign-in attempts per minute, and in several cases privileged cloud access in less than three hours. Teams that grant third-party apps broad Microsoft 365 permissions should audit those grants now, because cutting the ConnectWise connection may not remove an attacker already inside.

Who is it for?

Microsoft 365 admins, MSPs, security teams

Frequently asked questions

What should Microsoft 365 admins do about the ConnectWise compromise?: Microsoft advises keeping ConnectWise application connections disabled until ConnectWise gives restoration steps, preserving Entra sign-in and audit logs before deleting anything, and reviewing activity from at least October 15, 2026. Admins should look for credential additions, new app owners, consent grants and privileged role assignments, then remove and rotate any unauthorized credentials found.
Does Microsoft Defender detect the Storm-0940 ARTEX activity?: Microsoft lists detections across Defender XDR, Defender for Cloud Apps and Defender for Cloud for Key Vault. Named alerts include an application self-assigning the Global Administrator role, unusual Microsoft Graph activity tied to the compromised ConnectWise application, and suspicious app role assignments to a service principal. Microsoft also recommends turning on threat protection for AI services in Defender for Cloud.
Is ARTEX still open source after the Storm-0940 attacks?: ARTEX was released on GitHub earlier in 2026 by an account called Autumn-27, according to The Record. Its developer said the tool was misused, will no longer be updated and will move to closed source. ARTEX has also been linked to attacks on South Korean and Japanese financial institutions, and Microsoft says attackers from several regions have used it.
Were the Storm-0940 attacks on ConnectWise customers successful?: Microsoft says most of the Storm-0940 targeting failed, and the October 10–14 password spray against 327 accounts produced no successful sign-in. The later attacks through ConnectWise application identities did reach privileged cloud access at several organizations. Microsoft has not said how many customers were compromised or whether data was stolen.