Attackers were able to access Microsoft 365 environments by leveraging ConnectWise application identities that organizations had authorized, without needing user passwords or multi-factor authentication. According to Microsoft, the Storm-0940 group is responsible for the compromise, and a tool named ARTEX is believed to have been used to accelerate several stages of the operation.
A tenant, meaning an organization’s workspace in Microsoft 365, can be administered by applications to which it has granted permissions. Whoever controls these identities therefore has the application’s rights within each of these tenants. In several cases from the campaign conducted since September, less than three hours elapsed between initial targeting and obtaining privileged access, according to Microsoft, which did not specify if these organizations were ConnectWise customers.
Microsoft “assesses” that Storm-0940 is behind the compromise, without publishing a confidence level. ConnectWise, for its part, stated it could not “discuss attribution at this stage,” before acknowledging Microsoft’s conclusions on its Trust Center advisory page on October 21. Its status page mentions neither Storm-0940 nor AI.
ARTEX, an Open-Source Tool with Reported Uses
ARTEX is a multi-agent system, meaning a set of AI programs capable of acting autonomously, written in Go and published as open source. According to a Cloud Security Alliance note, it was posted online on July 26, 2026 by a developer signing as Autumn-27. CrowdStrike linked it in early October to intrusions in South Korean financial institutions. On October 8, the developer reportedly removed the project from GitHub and announced the end of updates, moving to closed-source code, but a project page remained public as of October 22.
Microsoft writes that Storm-0940 used ARTEX to accelerate reconnaissance, password spraying (trying one common password across a series of accounts), and OAuth application abuse. ARTEX “can use any AI model” and conducts an intrusion from reconnaissance to exfiltration “with little human interaction,” according to the same post, which does not specify the human role in the operation or the model used. The password spraying campaign conducted from October 10 to 14, 2026 resulted in over 151,000 failures against 327 accounts across eight organizations, with no successful authentications observed, according to Microsoft.
Attempts and Successful Connections
Microsoft indicates that the attacker attempted to sign in to over 2,250 tenants, and that the majority of this targeting failed. The company does not give a number of compromised tenants and clarifies that a successful authentication “does not necessarily indicate” access to data or its exfiltration.
Huntress, a security vendor, examined over 10,000 tenants equipped with ConnectWise applications. It counted 162 with confirmed unauthorized connections on October 16, then nearly 1,000 targeted from a single IP address on October 17, of which over 300 had a successful connection. In around fifty monitored tenants, applications assigned themselves directory administration roles, primarily that of Exchange administrator.
ConnectWise reported on October 16 “attempts” to access the Cloud Backup environment, formerly SkyKick. On October 17, the vendor acknowledged unauthorized access to application identities, disabled seven, and revoked the relevant certificates. On October 19, all accounts and credentials in the affected environment were reset. Phased restoration began on October 21 and is expected to last “several days.” Backup archives are “encrypted, isolated, and preserved, with no indication of compromise,” according to the company, which has entrusted the investigation to an unnamed third-party firm.
Microsoft recommends, among other things, leaving affected ConnectWise connections disabled, retaining Microsoft Entra logs, and reviewing activity from at least October 15, 2026. ConnectWise indicates that already-issued access tokens “may remain usable” until their expiration or invalidation.
