Microsoft ties ConnectWise Cloud Backup supply-chain attack to China-state aligned Storm-0940, which used the ARTEX AI framework

Microsoft says it assesses that Storm-0940, a group it describes as China-state aligned, was responsible for the recently disclosed supply-chain compromise of ConnectWise Cloud Backup, formerly SkyKick. The company laid out the attribution in a Microsoft Security blog post on October 21.

Who Microsoft says is behind it. Microsoft describes Storm-0940 as a China-state aligned actor, with no known industry aliases, that has been active since 2021 and targets organizations across many industries for data theft. Microsoft says the group has historically gained access through password spraying and exploitation of internet-facing applications, and has kept access to Microsoft 365 by adding credentials to existing OAuth applications. ConnectWise says that, based on its evidence and threat intelligence shared by Microsoft, it appears a China state-aligned group was responsible.

An agentic AI framework did the legwork. According to Microsoft, as early as September 2026 Storm-0940 used ARTEX, an open-source agentic AI penetration testing framework, to automate attacks on hundreds of organizations worldwide in sectors including aerospace and defense, energy, financial services, government, legal, manufacturing, semiconductors and technology. Microsoft says several of these attacks gave the group privileged access to cloud infrastructure, in multiple cases less than 3 hours after initial targeting. Microsoft says most of the targeting was not successful, and that threat actors in several regions are now using ARTEX.

Trusted app identities opened the door. Microsoft says that after taking control of identities belonging to multiple ConnectWise cloud applications, the group authenticated to customer Microsoft 365 environments through apps that had already been granted access, so no interactive user sign-in was needed. Microsoft says the group used ARTEX to attempt sign-ins to more than 2,250 tenants. In some environments, Microsoft says, activity went on through Microsoft Graph to reconnaissance, application credential changes and attempts to change privileges and roles, which could leave a backdoor in place even after the original app is fixed.

What Microsoft says was not affected. Microsoft says the activity did not result from a compromise of, or a vulnerability in, Microsoft corporate systems, products or services. It also says an affected app being present, or even a successful sign-in by the attacker, does not necessarily mean customer data was accessed or taken. Microsoft has not said how many tenants were compromised.

How ConnectWise responded. ConnectWise says it disabled seven ConnectWise application identities at 07:00 UTC on October 17 and suspended Cloud Backup by revoking certificates used for the affected connections, so the shared Cloud Backup credentials are no longer valid. The company warns that disabling the apps does not reverse changes already made inside a tenant, and that previously issued access tokens may stay usable until they expire. SaaS Security and Cloud Management were also suspended as a precaution. ConnectWise says existing backup archives remain encrypted and isolated with no indication of compromise, and that phased restoration began on October 21 and is expected to take several days.

What admins should check. Microsoft and ConnectWise both advise the following for every Microsoft 365 tenant where the affected apps are or were installed:

• Keep affected ConnectWise app connections disabled until ConnectWise issues formal restoration instructions, and don't delete the enterprise apps first; preserve their configuration and logs as evidence.
• Search by application ID, not display name, and review service principal sign-ins from at least October 13 onward, as ConnectWise advises (Microsoft says at least October 15), and back to October 1 where logs allow, as Microsoft advises. Microsoft lists four app IDs to check: Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae), MS Teams (24205314-2b89-4e07-a2a4-579e898a5640), MS Graph (0de14c77-b9b0-4137-9360-34878a929827) and SkyKick Partner Portal (c921256f-04a7-44e8-9b2a-69c33929ba19). ConnectWise's guidance lists seven identities. Look at both successful and failed sign-ins, and don't limit the review to the published IP addresses.
• Check Entra audit logs for new app or service principal credentials, new owners, consent grants, app-role and privileged role assignments, and Conditional Access changes.
• Check Microsoft 365 audit records for unusual mail or file access, forwarding, inbox or transport rules, and delegated mailbox permissions.
• Have an authorized responder remove confirmed unauthorized credentials, grants and role assignments after preserving evidence. Microsoft and ConnectWise list indicators, including the 144.172.64.x addresses, in their guidance.