Microsoft ties Storm-0940 and ARTEX to ConnectWise

Microsoft said on Oct. 21 that a China-aligned group it calls Storm-0940 used the open-source ARTEX framework, from as early as September 2026, against hundreds of organizations and in the ConnectWise Cloud Backup compromise. It said the group then reached more than 2,250 tenants at 2,900 sign-in attempts per minute, that the activity was not caused by a flaw in Microsoft products, and that a successful sign-in does not by itself show customer data was taken. ConnectWise said on Oct. 22 that restoration is phased, its backup archives show no sign of compromise, and customer Microsoft 365 tenants still need review.