Microsoft attributes a ConnectWise multitenant application compromise to Storm-0940 and describes ARTEX agents conducting credential discovery and follow-on operations. Stolen application credentials crossed an existing customer trust relationship; successful authentication alone does not establish data theft. Investigation. Mechanism, preconditions and…
Inspect the ClaimsCase · DiggingBeagle record
Storm-0940 used ARTEX and stolen ConnectWise application credentials
Scope
Microsoft telemetry from September-October 2026; no Microsoft corporate or product compromise is established.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- confirmed in the wild
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- BY AI
Basis and provenance
CLM-STORM0940-CONNECTWISE-1 reports: Microsoft observed attempted sign-ins to more than 2,250 tenants after unauthorized ConnectWise access; this is an attempted-access population, not a confirmed-victim count. Source SRC-2026-CP17-MS-STORM0940 is located at 'ConnectWise advisory paragraph immediately before the Password Spraying section'. The distinctive mechanism begins: Microsoft linked Storm-0940's ARTEX automation to credential abuse involving ConnectWise cloud backup application identities. Classification: setting=production, exploit_status=confirmed_in_the_wild, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=mitigation_available; scoped control or limit: Preserve tenant evidence before deleting app objects; identify the four affected application IDs, review service-principal sign-ins and subsequent Graph audit operations, then revoke unauthorized grants and rotate changed credentials. Disabling the original compromised integration cannot remove independently added credentials or privileged roles. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.
Assessed Oct 23, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-STORM0940-CONNECTWISE-1 · CLM-STORM0940-CONNECTWISE-2 · CLM-STORM0940-CONNECTWISE-3 · Microsoft: Storm-0940, ARTEX and ConnectWise application trust
At a glance
Confirmed victim population, exfiltration volume and complete initial access remain unresolved.
Limits and uncertaintyFull account
Microsoft attributes a ConnectWise multitenant application compromise to Storm-0940 and describes ARTEX agents conducting credential discovery and follow-on operations. Stolen application credentials crossed an existing customer trust relationship; successful authentication alone does not establish data theft. Investigation.
Mechanism, preconditions and effects. Microsoft linked Storm-0940's ARTEX automation to credential abuse involving ConnectWise cloud backup application identities. After those identities were compromised, the actor used existing application grants to attempt access across more than 2,250 Microsoft 365 customer tenants at machine speed. Microsoft separately observed Graph reconnaissance, application credential modifications and privileged-role operations in some tenants; an earlier October 10 to 14 password spray generated 151,000 failed events against 327 accounts across eight organizations and did not succeed in that measured subset.
Comparison and evidence limits. Attempts, successful token issuance, Graph activity, privileged persistence and data exfiltration are separate stages; the Microsoft report expressly warns that reach or a successful sign-in does not by itself establish data theft. The earlier spray is a different telemetry subset and must not be added to the downstream-tenant count. ARTEX accelerated an existing supply-chain OAuth trust failure rather than exploiting a new Microsoft software vulnerability.
Timeline
- Oct 21, 2026disclosure
Public disclosure
Claims & evidence
CLM-STORM0940-CONNECTWISE-1Microsoft observed attempted sign-ins to more than 2,250 tenants after unauthorized ConnectWise access; this is an attempted-access population, not a confirmed-victim count.supported
Basis: reported finding
- supportsMicrosoft: Storm-0940, ARTEX and ConnectWise application trustprimary disclosure
ConnectWise advisory paragraph immediately before the Password Spraying section
CLM-STORM0940-CONNECTWISE-2A distinct October 10-14 password spray produced over 151,000 failures against 327 accounts in eight organizations, with no successful authentication observed in that spray.supported
Basis: reported finding
- supportsMicrosoft: Storm-0940, ARTEX and ConnectWise application trustprimary disclosure
Password Spraying
CLM-STORM0940-CONNECTWISE-3In some downstream environments, Microsoft observed Graph reconnaissance and credential modifications intended to establish persistence.supported
Basis: reported finding
- supportsMicrosoft: Storm-0940, ARTEX and ConnectWise application trustprimary disclosure
Downstream customer access
Controls and mitigations
- Preserve tenant evidence before deleting app objects; identify the four affected application IDs, review service-principal sign-ins and subsequent Graph audit operations, then revoke unauthorized grants and rotate changed credentials. Disabling the original compromised integration cannot remove independently added credentials or privileged roles.
Unknowns and contradictions
- Confirmed victim population, exfiltration volume and complete initial access remain unresolved.
Sources and citation
Material revision history
- Oct 23, 2026 · Canonical change recorded · new in release · revision 183