# Storm-0940 Tried to Access More Than 2,250 Microsoft 365 Tenants By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/37648 Published: 2026-10-22T08:42:18.000Z Updated: 2026-10-22T08:42:18.000Z Section: Technology > The group used compromised ConnectWise Cloud Backup application credentials. Activity in multiple customer environments went beyond attempted sign-ins. Storm-0940, a China state-aligned hacking group, used compromised ConnectWise Cloud Backup application credentials to try to enter more than 2,250 Microsoft 365 tenants through applications customers had already authorized. The tenant count measures attempted sign-ins, not confirmed compromises. In multiple customer environments, the activity went beyond authentication to reconnaissance and changes to application credentials. Those observations do not establish how many customers, if any, suffered data theft. The compromised application identities gave the attackers a route through existing customer permissions. Disabling an affected vendor connection may leave behind credentials or privileges added inside a customer tenant, making a review of each environment necessary. Storm-0940 also used ARTEX, an open-source framework that can use AI models to automate penetration-testing tasks, against hundreds of organizations worldwide beginning at least in September 2026. Its targets included organizations in financial services, energy, government and technology. In several attacks across the wider campaign, the group gained privileged cloud access less than three hours after it began targeting an organization. ARTEX also appeared in [earlier investigations of attacks on South Korean financial institutions](). From Oct. 10-14, a password-spray phase targeted 327 accounts at eight organizations. Password spraying involves trying passwords across multiple accounts. The activity generated more than 151,000 failed logons and peaked at 2,900 failures per minute on Oct. 11. No successful authentication was observed in that phase. ConnectWise discovered the issue Oct. 14 and published its first advisory at 1:47 p.m. ET (17:47 UTC) Oct. 16. It has since disabled affected application connections. At 8:45 p.m. ET Oct. 21 (00:45 UTC Oct. 22), restoration was underway in phases and expected to take several days. ConnectWise found no indication that stored backup archives were compromised. “We have not identified confirmed downstream customer compromise,” ConnectWise said. Customer tenants still require review for unauthorized changes or access that could remain after the affected connections were disabled. ## Links in this article - [earlier investigations of attacks on South Korean financial institutions](https://www.tokenpost.com/news/technology/27958)