On 21 October 2026, Microsoft Threat Intelligence named the China state-aligned actor Storm-0940 as the one behind the recent ConnectWise supply chain attack. The target was a multi-tenant application. The actor used ARTEX, an open-source AI penetration testing framework, to move fast once it held the application’s credentials. If your Microsoft 365 tenant ever trusted a ConnectWise cloud app (Cloud Backup, MS Teams or MS Graph), you have a short list of checks to run.
What Microsoft Says Happened
Storm-0940 has been active since 2021. Microsoft describes ARTEX as a multi-agent framework that can run tests from reconnaissance to data exfiltration with little human input. It works with any AI model. The earliest known use Microsoft saw was in September 2026.
Using stolen application credentials, ARTEX-driven agents tried to sign in to more than 2,250 tenants. They reached about 2,900 sign-in attempts per minute. Microsoft also saw a password spray from 144.172.64[.]99 against 327 accounts at eight organizations between 10 and 14 October, with no successful sign-in observed.
Microsoft states the activity did not result from a compromise of, or a vulnerability in, its own corporate systems, products or services. The weak point was a trusted vendor application. That is the classic shape of a supply chain compromise: the attacker does not break your door, it uses a key you already gave to someone else.
Why a Trusted App Is Hard to Spot
The actor signed in through apps that tenants had already authorized, so no user had to log in. It then used Microsoft Graph to look around, change application credentials, and touch identities, groups and privileged roles. One of Microsoft’s detections covers an application that gave itself the Global Administrator role.
Microsoft also warns that an added credential can outlast the clean-up of the original app. Fixing the vendor side does not remove a secret the actor planted inside your tenant. This maps to MITRE ATT&CK T1195 Supply Chain Compromise and T1098.001 Additional Cloud Credentials, plus abuse of valid accounts.
What to Check in Your Tenant
Microsoft’s immediate actions, in plain order:
- Keep the affected ConnectWise app connections disabled until ConnectWise gives formal restore steps.
- Do not delete the enterprise apps first. Save their configuration and evidence.
- Find the apps by application ID, not display name, and note each tenant’s service principal Object ID.
- Keep Entra sign-in and audit logs, Purview audit records and Graph telemetry before you do anything else.
- Review activity from at least 15 October 2026. Where logs allow, check service principal sign-ins back to 1 October.
- Look at successful and failed service principal sign-ins separately, and do not limit the search to the published IPs.
- In Entra audit logs, look for added credentials, new apps, owners, consent grants, app role assignments and privileged role changes.
- In Microsoft 365 audit logs, look for directory listings from unusual IPs, mail or file downloads, forwarding, inbox rules and delegated mailbox permissions.
Only after the evidence is saved should an authorized responder remove confirmed unauthorized credentials, grants and role assignments.
Indicators Microsoft Lists
Microsoft lists three IP addresses seen in sign-ins and Graph activity in customer environments: 144.172.64[.]128, 144.172.64[.]99 and 144.172.64[.]60. Three VPN addresses (187.15.88[.]186, 187.15.90[.]217 and 187.15.89[.]186) reached Graph through the compromised apps. Microsoft calls them transient, and they matter mainly for 15 and 16 October.
The user agents seen were Python-urllib/3.12, python-requests/2.31.0, python-requests/2.34.2, curl/7.88.1 and azure-toolkit/1.0. Microsoft’s hunting queries use three application IDs.
- 506e08f9-6e9a-4da4-942b-a099a03644ae is ConnectWise Cloud Backup.
- 24205314-2b89-4e07-a2a4-579e898a5640 is ConnectWise – MS Teams.
- 0de14c77-b9b0-4137-9360-34878a929827 is ConnectWise – MS Graph.
Microsoft’s text says “all four application IDs” but its page lists only these three, so a fourth ID may be missing; check the Microsoft page for updates. Microsoft adds that an affected app or a successful sign-in does not by itself prove data was read or taken.
What MSPs and Their Customers Should Do Next
This case is a reminder to know which vendors hold standing access to your cloud. Keep a list of multi-tenant apps, the permissions each one holds and who approved them. Apply least privilege to consent grants, and alert on credential additions and on apps assigning roles to themselves. Our supply chain attack and vendor risk use case covers how to track that outside access.
Microsoft notes that vendor credential rotation must be verified in each tenant. Backup and restore workflows may be affected until ConnectWise restores service. Microsoft also saw a password spraying run from the same address range, so lockout alerts are worth a look. For the wider picture of AI-driven attack tools, see our article on how attackers use agentic AI against organizations.