Reach is not the same as breach
The number that will travel from this report is 2,250. It deserves its footnote. That figure counts tenants the actor attempted to sign in to after taking over ConnectWise application identities. It is a measure of reach through a trusted vendor connection, not a count of compromised tenants, and Microsoft is careful to separate the two: most of the targeting was not successful, and even a successful authentication, it says, does not necessarily mean data was accessed or taken.
The one phase Microsoft measures end to end cuts the other way. Between 10 and 14 October, before the ConnectWise phase, Storm-0940's password spray produced more than 151,000 failed logons against 327 accounts and, on Microsoft's telemetry, not one successful authentication. Nearly all of it hit account lockouts. An automated attacker working at machine speed generated a great deal of noise and, in that phase, no entry at all.
Neither number cancels the other. The spray shows the failure rate when the attacker still has to guess. The ConnectWise phase shows what changes when it no longer does: the sign-ins rode on application identities tenants had already trusted, which is why the same report can honestly contain 2,900 attempts a minute and a majority failure rate. The compromised application identities supplied the trusted access paths. Microsoft assesses that ARTEX accelerated the reconnaissance and authentication attempts run through those paths; its report demonstrates the resulting pace, but does not quantify how much faster the operation was than an equivalent attack without AI.
What the AI actually added
Storm-0940 is not a new actor and its methods are not new. Microsoft dates the group to 2021 and describes the same playbook throughout: password spraying, exploiting internet-facing applications, then persisting in the cloud by adding credentials to existing OAuth applications and pulling mail and other data through Microsoft Graph. ARTEX automates that sequence. Originally released as open source, it is a multi-agent system that runs reconnaissance through exfiltration with little human interaction, accumulating what it finds into a graph as it goes.
So the change to price in is time. Microsoft reports several cases of under three hours from first targeting to privileged access, against defenders who now have to notice, correlate and act inside that window, across a target set of hundreds of organisations attacked in parallel, around the clock. That is a staffing and automation problem for defence, not a new category of attack, and it is why Microsoft's recommended response is unglamorous log work: service-principal sign-ins, credential additions, privilege changes, reviewed tenant by tenant.
This is also the second time ARTEX has moved from tool to incident in a month. When its developer took it closed-source in early October, after it was linked to breaches at South Korean financial institutions, the obvious point was that copies already downloaded stayed in circulation. Microsoft now says threat actors across multiple geographic regions are using it, and attributes its largest known operation to a state-aligned group. Closing the repository changed who could newly download it. It did not change who already had it.
The part that survives disconnection
The detail with the longest tail is persistence. In the environments where the agents got further, Microsoft observed them modifying application credentials and privileges, the kind of change that can remain as a working backdoor after the original compromised application is cut off. ConnectWise's own chief executive made the same point from the vendor side: containing the application connections does not remove access that may already have been established inside individual tenants.
That is why Microsoft's guidance reaches tenants that no longer run the app, and why its review window starts on 15 October rather than on the day of its report. For an MSP or an internal IT team, the work is not checking whether ConnectWise Cloud Backup is installed today. It is checking what its application identities did, and what credentials exist now that did not exist before mid-October. Microsoft lists four application IDs for that inventory — ConnectWise Cloud Backup, ConnectWise – MS Teams, ConnectWise – MS Graph and the SkyKick Partner Portal — and tells defenders to search by application ID rather than display name, recording each tenant's local service-principal object ID.
What is still missing from the record is the number readers will most want: how many tenants, if any, had data accessed or exfiltrated in this campaign. Microsoft reports attempted access across more than 2,250 tenants and follow-on activity in multiple customer environments, but it does not publish a total of confirmed data-theft victims, and its report is explicit that an affected application or a successful authentication is not, by itself, evidence of data access or exfiltration. The defensible conclusion is a wide attempted operation, evidence of narrower successful intrusions, and an undisclosed data-theft total — not proof that no data was taken, and not proof that it was.
Sources
- [1] Microsoft Threat Intelligence, "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise", Microsoft Security Blog, 21 October 2026 — read directly for this article: the attribution to Storm-0940, the 2,250+ attempted tenant sign-ins at 2,900 attempts a minute, the separate 10–14 October password-spray telemetry (151,000+ failed logons, 327 accounts, eight organisations, no successful authentication observed), the under-three-hour cases, all caveats, the tenant guidance and the four application IDsRead source
- [2] Reuters, "Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says", 21 October 2026, via syndication — independent confirmation of the attribution and the sector list; ConnectWise CEO Manny Rivelo, quoted by Reuters, on containment and tenant-level reviewRead source
- [3] ALFW, "ARTEX Goes Closed-Source After Korean Bank Hacks. The Attackers Already Have Their Copy.", 9 October 2026 — our earlier reporting on ARTEX's move to closed source, for the framework's backgroundRead source