← All Threat Actors
Storm-0940
China-state aligned (Microsoft assessment; no formal confidence level given, no independent confirmation found) · Data theft across multiple industries
Reports 1
Active Since 2021 (per Microsoft)
Last Reported 23 Oct 2026
Sectors Targeted finance, critical-infrastructure, communications
Tactics, Techniques & Procedures (TTPs)
- October 2026: attributed by Microsoft to the ConnectWise Cloud Backup supply-chain compromise, using compromised multi-tenant application credentials to attempt sign-in to 2,250+ downstream tenants
- Uses ARTEX, an open-source agentic AI penetration-testing framework (LLM-driven agents from recon to exfiltration); Microsoft reports use from September 2026 and says other actors also use it. Microsoft does not say ARTEX was used to obtain the ConnectWise credential
- Password spraying: Oct 10-14 campaign from 144.172.64[.]99 against 327 accounts in 8 organisations, 151,000+ failed logons, no successful authentication observed
- Post-authentication Graph and directory activity: credential additions for persistence, role and group changes
- Microsoft reports privileged access in under three hours in multiple instances, but says most targeting was unsuccessful
Known Targets
Downstream tenants of ConnectWise Cloud Backup customersBroader ARTEX campaign sectors per Microsoft: aerospace and defence, energy, financial services, government, manufacturing, semiconductors (not necessarily ConnectWise victims)
Analyst Notes
Microsoft says Storm-0940 has no known industry aliases and that the activity did not result from a compromise of its own systems. Attribution rests on Microsoft's assessment alone; CyberScoop repeats it. An affected application or successful sign-in does not by itself show data was accessed. See our October 23 flash briefing.