# Storm-0940: an AI pentest agent drove the ConnectWise tenant breach

> Microsoft says a China-state-aligned actor ran the ConnectWise supply chain compromise with an open-source AI pentest agent.

- **Severity:** Critical: Exploited in the wild, or easy remote code execution or data theft in a widely used product with no fix. Act today.
- **Category:** Incident, Supply chain, Attack
- **Published by:** Microsoft
- **Disclosed:** 2026-10-21
- **Affects:** ConnectWise Cloud Backup, Microsoft 365, Microsoft Entra ID
- **Research by:** Microsoft Threat Intelligence, Sapir Federovsky (Wiz Research), Rami McCarthy (Wiz Research), Jonathan Semon (Huntress)
- **Primary source:** https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
- **Page:** https://theinjection.dev/items/microsoft-storm-0940-artex-connectwise/

Microsoft attributes the ConnectWise Cloud Backup compromise to Storm-0940, a China-state-aligned actor that used the open-source ARTEX agent framework to attempt sign-ins to over 2,250 Microsoft 365 tenants.

## What happened

Microsoft Threat Intelligence published its analysis on October 21, 2026, assessing that Storm-0940 was behind the ConnectWise supply chain compromise. ConnectWise disclosed unauthorized access to application identities in its Cloud Backup environment on October 16, a day after Huntress first reported that a vendor credential was being abused against customer Microsoft 365 tenants. Microsoft says the actor has used the ARTEX framework since as early as September 2026, against hundreds of organizations globally.

## How it works

ARTEX is an open-source multi-agent penetration testing framework that drives an autonomous pentest from reconnaissance through exfiltration, collecting discovered assets and findings into a shared graph. Storm-0940 held a stolen ConnectWise application credential, so its agents authenticated into customer tenants through an application those tenants already trusted, with no user action and no password to guess. In some environments the agents went on to Microsoft Graph and directory operations, adding application credentials and changing identities, groups and privileged roles to keep access.

## Who is affected

Organizations that authorized ConnectWise Cloud Backup, formerly SkyKick, or the ConnectWise Cloud Management applications in Microsoft Entra ID are in scope. Huntress had confirmed unauthorized sign-ins in 162 tenants by October 16 and later found sign-in activity from the main attacker address in almost 1,000 Entra tenants, more than 300 of them successful. Microsoft states the activity did not result from a compromise of or a vulnerability in Microsoft corporate systems, products or services.

## What to do

Keep affected ConnectWise connections disabled until ConnectWise publishes formal restoration instructions, and disable rather than delete the enterprise applications so that evidence and consent survive. Review service principal sign-ins and Entra audit records from at least October 15, 2026, extending to October 1 where logs exist, and remove any application credential, owner, role assignment or consent grant you did not create. Disabling an application does not remove credentials the actor already added.

## Quick facts

- **Affected:** ConnectWise Cloud Backup (formerly SkyKick) and Cloud Management apps in Microsoft 365
- **Attack type:** Supply chain abuse of a trusted multi-tenant app, driven by an autonomous AI pentest agent
- **Scale:** Sign-in attempts against more than 2,250 tenants; 162 tenants with confirmed unauthorized sign-ins
- **Speed:** Under 3 hours from initial targeting to privileged access, in multiple instances
- **Attribution:** Microsoft assesses Storm-0940, a China-state-aligned actor active since 2021
- **Found by:** Huntress on October 16, with analysis by Microsoft Threat Intelligence and Wiz Research
- **Status:** ConnectWise Cloud Backup offline, with no formal restoration instructions at publication

## Questions

### Am I affected if my tenant authorized ConnectWise Cloud Backup?

Any Microsoft 365 tenant that authorized ConnectWise Cloud Backup or the ConnectWise Cloud Management applications should be treated as in scope. Huntress confirmed unauthorized sign-ins in 162 tenants and saw activity from the primary attacker address in almost 1,000 Entra tenants, over 300 of them successful. Microsoft advises reviewing service principal sign-ins and audit records from at least October 15, 2026.

### Does disabling the ConnectWise application remove the attacker's access?

Disabling the enterprise application stops new sign-ins but does not remove credentials the actor already added. Huntress warns that disabling apps will not remove credentials that were already added, so defenders must review credentials on enterprise applications and app registrations and delete any added since October 13 that they did not create. Microsoft also advises against deleting the applications first, because deletion destroys evidence and consent.

### What makes the Storm-0940 campaign different from an ordinary password spray?

Storm-0940 drove the intrusion with ARTEX, an open-source multi-agent penetration testing framework, rather than by hand. Microsoft reports that in multiple instances fewer than three hours passed between initial targeting and privileged access, and that the actor chained steps automatically across hundreds of organizations. Wiz Research, tracking the same tooling, recorded sessions running 24 to 30 hours with new addresses appearing within minutes of a block.

### Was Microsoft itself breached in the ConnectWise campaign?

Microsoft states that the ARTEX-driven activity did not result from a compromise of or a vulnerability in Microsoft corporate systems, products or services. The actor instead used a stolen ConnectWise application credential to authenticate into customer tenants through an application those tenants had already trusted. Microsoft also cautions that a successful authentication alone does not establish that customer data was accessed or exfiltrated.

## Sources

1. [Microsoft Analysis](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/)
2. [Huntress Disclosure](https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access)
3. [Wiz Research Tracking](https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors)