New turn in the ConnectWise attack as Microsoft names Storm-0940

The attack hit customers of ConnectWise, a software vendor, through its Cloud Backup service. ConnectWise stopped its services on Saturday and began to put them back in phases on Wednesday.

Microsoft says a group that it calls Storm-0940 caused the recent attack on ConnectWise customers. The group is aligned with the Chinese state. Microsoft says the group used ARTEX, a tool that lets AI agents do attacks with almost no help from a person. The group did this as early as September 2026 against hundreds of organizations. A Microsoft vice president says this attack is one of many in a wave of AI attacks since the start of October.

How it works

ARTEX is an open source set of AI agents. It works with all AI models and does an attack from the first scan to the theft of data. Here, the agents tried passwords and used OAuth apps, which get access to accounts. Some agents then changed app credentials to keep access, and changed roles with high rights.

The numbers

In the days before 14 October, the group tried 327 accounts and caused more than 151,000 failed logons. That campaign did not succeed. The next day, the group went for ConnectWise customers. Microsoft says the group reached more than 2,250 tenants, the company accounts in the cloud, at 2,900 tries each minute.

What is not known

Microsoft did not say how many customers the group harmed. A logon that works does not prove that the group stole data. ConnectWise tells customers to keep connections off and expects the recovery to continue for some days.

Insight: An open attack tool means no one AI maker can stop it

Microsoft says ARTEX works with all AI models. Zscaler says one operator used it with Claude Code, Codex and Grok. This looks like a tool that rules at one AI maker cannot stop, and thus the defense moves to the app rights of a vendor. Microsoft says an app with high rights gave access to more than its purpose. Check those rights first.