Microsoft Attributes ConnectWise Supply-Chain Attack to Storm-0940
A supply-chain attack on ConnectWise customers has been attributed to Storm-0940, a China-state aligned threat actor. The attack targeted Microsoft 365 and Exchange Online accounts across multiple sectors.
OffSet7 Newsroom · Reviewed by an OffSet7 analyst · AI-assisted
What happened
Supply-chain attack on ConnectWise customers attributed to Storm-0940.
Who is affected
Microsoft 365, ConnectWise Cloud Backup, 327 accounts across eight organizations.
Exploited
The attack targeted hundreds of organizations globally.
What to do
ConnectWise advised customers to review their logs for unauthorized access.
Microsoft has attributed a recent supply-chain attack targeting ConnectWise customers to Storm-0940, a threat actor aligned with China. The group has been active since at least 2021 and initiated its campaign against ConnectWise in September 2026.
The attack utilized the ARTEX AI penetration testing framework to automate assaults on hundreds of organizations globally. Storm-0940 targeted 327 Microsoft 365 and Exchange Online accounts across eight organizations, resulting in over 151,000 failed logon attempts.
The attack reached a peak of 2,900 failed logon attempts per minute. Despite the high number of attempts, Microsoft noted that most were unsuccessful, though the group achieved persistent access in many cases.
Storm-0940 managed to gain privileged access to cloud environments in under three hours in some instances. The attack affected various sectors, including aerospace, defense, automotive, chemicals, and more.
In response, ConnectWise temporarily shut down services and began restoring them in phases. The company advised customers to review their logs for any unauthorized access following the incident.
