Observed incident
Microsoft links ARTEX to the ConnectWise cloud-credential compromise
Reported
Published here
What happened
Microsoft attributes the ConnectWise application-credential compromise to Storm-0940 and reports ARTEX-assisted access, reconnaissance and persistence in downstream Microsoft 365 environments.
Parties and reporting
AI tools and systems: ARTEX agentic penetration-testing framework, ConnectWise Cloud Backup and Cloud Management, Microsoft Entra and Microsoft Graph
Outcome
ConnectWise reset credentials and reported phased service restoration on October 22. Huntress found planted application secrets in two tenants. Successful authentication alone does not establish data theft; downstream investigations continue.
Operating lesson
Audit app-only sign-ins, new application credentials and privilege changes; remove unauthorized persistence and follow the provider’s restoration guidance before reconnecting.
Evidence and limits
ConnectWise and Huntress disclosures are dated October 16; Microsoft’s AI attribution followed October 21. China-state alignment is Microsoft’s assessment, not inferred from tool language. Separate from the Korean ARTEX case. The reported password-spray wave failed; tenant attempts are not victim counts. No Microsoft product vulnerability was identified.
Sources
- Microsoft investigation and ARTEX attribution
Primary source ·
- ConnectWise original advisory and restoration updates
Primary source ·
- Huntress tenant investigation and October 19 update
Primary source ·