Microsoft research published October 21, 2026; Wiz analysis published October 22, 2026
Microsoft Ties Storm-0940 and the ARTEX AI Agent to the ConnectWise Compromise: 2,250 Tenants Targeted
Microsoft attributed the compromise of ConnectWise Cloud Backup application identities to Storm-0940, a China-aligned actor, and said the group used ARTEX, an open-source autonomous penetration testing framework, to attempt sign-ins to more than 2,250 Microsoft 365 tenants through application permissions customers had already granted, peaking at about 2,900 attempts per minute. Most attempts failed, and Microsoft is careful that the figures describe targeting and attempted authentication, not a count of organizations that lost data, but it also reports privileged persistence in some environments and, in some cases, a path from target selection to privileged cloud access in under three hours. Separately, between October 10 and 14, Microsoft observed more than 151,000 failed sign-in attempts against 327 accounts across eight organizations. Wiz reports the same ARTEX tooling aimed across the IT and software vendor sector throughout October, hitting Okta, Entra ID, and AWS Cognito login flows, with sessions lasting 24 to 30 hours and new IP addresses appearing within minutes when old ones were blocked. ARTEX was published on GitHub in July 2026, won Baidu's Agent+ red team challenge in September, and was made closed-source on October 8 after more than 12,000 forks, by Wiz's count.
Executives
The entry point was not a flaw in your systems. It was a vendor's application identity that your tenants had already trusted, used at machine speed. One supplier connection reached more than 2,250 customer environments, so the governing question is which third-party applications hold standing permissions in your cloud tenants today, and when anyone last reviewed them.
CIO / CISO
Audit every third-party OAuth application and service principal now: list granted permissions, flag broad Graph rights such as directory write access, review application credential changes, and hunt for service principal sign-ins that do not match vendor patterns. Treat any tenant the ConnectWise identities touched as needing its own review, because persistence created through a modified application identity can survive the vendor disabling the original connection.
Engineers
Pull Entra sign-in and audit logs for the October window and look for the ARTEX pattern Wiz documents: source map and JavaScript bundle downloads followed minutes later by calls to internal API routes by name, bursts of sign-in attempts at roughly one per second, unsigned JWT probes against SSO routes, and repeated password reset and account recovery calls. Block and hunt the IP addresses and user agents in the Wiz indicator list, while remembering several are noisy on their own.
Everyone (non-IT)
If your company uses a managed IT provider or a cloud backup tool, you may be asked to reconnect services or reapprove an application this week. That friction is the cleanup: a trusted connection was abused, and re-establishing it deliberately is how your IT team confirms it is really the vendor on the other end.