Microsoft links ConnectWise compromise to Storm-0940 as AI scales cloud identity attacks

Microsoft says an AI-assisted campaign using stolen application credentials reached more than 2,250 Microsoft 365 tenants, while investigators warn that exposure, persistence and confirmed data theft must not be conflated.

Microsoft has linked a compromise involving ConnectWise to Storm-0940, a China-aligned threat actor, and said the campaign was accelerated by agentic artificial intelligence used to help exploit stolen application credentials across Microsoft 365. In a security update dated 21 October 2026, the company said the activity touched more than 2,250 Microsoft 365 tenants, underscoring how identity-led attacks can scale rapidly when they exploit trusted software and legitimate authentication paths.

That reach figure, however, should not be read as a confirmed tally of breached organisations. The available reporting does not show that every tenant encountered by the activity suffered theft of data, and a successful sign-in alone does not prove that sensitive information was accessed or removed. The episode instead highlights a familiar but increasingly serious problem for defenders: attackers can sometimes live off the land inside cloud environments, using valid credentials and permissions rather than conspicuous malware.

Microsoft said Storm-0940 used ARTEX to speed up the misuse of compromised application credentials. While that points to a more efficient operational model, the public record does not make clear how much of the campaign was automated, which steps were handled by software, or whether the tool independently selected targets. As a result, the incident should be understood as AI-assisted rather than automatically assumed to be a fully autonomous attack.

The company also said it observed follow-on Microsoft Graph activity and changes to application credentials in some environments. Those behaviours are significant because they can indicate efforts to preserve access after the original application is disabled. For investigators, that means the key questions are not only whether an application authenticated successfully, but also what it touched, which permissions it held, and whether any new credentials or privilege changes created alternative routes back into the tenant.

Huntress has separately documented unauthorised application access and persistence linked to the incident, adding technical weight to concerns about application-based compromise. But the security firm has not independently confirmed Microsoft’s attribution to Storm-0940, which means the threat-actor assessment should still be treated as Microsoft’s own analysis. The distinction matters: evidence of suspicious access is not the same as proof of who was behind it.

The wider lesson is that cloud identity now sits at the centre of supply-chain defence. Microsoft 365 tenants often hold email, documents, collaboration histories and links into other business systems, so a compromised service principal can create a much broader exposure than a single sign-in event might suggest. Security teams, therefore, need to scrutinise non-human identities, review application consent and permissions, and distinguish carefully between exposure, persistence and confirmed exfiltration before declaring the incident contained.

Source Reference Map

Inspired by headline at: ^[1]

Sources by paragraph:

• Paragraph 1: ^[1]
• Paragraph 2: ^[1]
• Paragraph 3: ^[1]
• Paragraph 4: ^[1]
• Paragraph 5: ^[1]

Source: Fuse Wire Services