Storm-0940 - f4n6

notes

Storm-0940 uses AI tool ARTEX to breach 2,250 M365 tenants via ConnectWise

1. Executive summary Microsoft attributes a supply chain compromise of ConnectWise Cloud Backup (formerly SkyKick) to Storm-0940, a China-state-aligned actor active since 2021,

22 Oct 2026 · 8 min read read →

notes

Storm-0940 uses ARTEX AI agents in ConnectWise supply chain attack

1. Executive summary Microsoft attributes the ConnectWise Cloud Backup supply chain compromise to Storm-0940, a China state-aligned actor active since 2021, which used the

22 Oct 2026 · 8 min read read →

notes

Storm-0940 uses ARTEX AI to compromise ConnectWise supply chain and abuse OAuth

1. Executive summary Microsoft attributes a supply chain compromise of ConnectWise multi-tenant applications to Storm-0940, a China-state aligned actor active since 2021, and

21 Oct 2026 · 8 min read read →