Microsoft published its analysis on 21 October: "Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application". Storm-0940 is a China-state aligned actor Microsoft has tracked since 2021.

We covered that compromise twice without an attribution, including the day the outage passed ninety-six hours. This fills that in, and the numbers inside it are more interesting than the name.

The spray: enormous, and a total failure

Between 10 and 14 October, from a single address, the actor ran a password-spray campaign against ConnectWise-adjacent tenants. Microsoft's figures:

327 accounts across eight organisations. More than 151,000 failed logon events, 111,000 of them in a single day, peaking at 2,900 failures per minute on 11 October. And then, from Microsoft: "Despite the scale, no successful authentication, token issuance, Graph call, or directory change was observed."

Not a low success rate. Zero. Forty-eight accounts absorbed more than a thousand failures each, lockouts ran at nearly 98 percent of the activity, and the actor still did not get into a single account that way.

The part that worked made no sign-in to see

Meanwhile, the actor held identities for multiple ConnectWise cloud applications, and used them to authenticate into customer Microsoft 365 environments through already-authorised applications, without an interactive user sign-in.

Microsoft found "multiple customer environments with evidence of follow-on activity" through Microsoft Graph: reconnaissance, changes to application credentials, attempts to change privileges. Its technique mapping records self-assignment of Global Administrator from one ConnectWise management application.

Put the two halves side by side. One generated 151,000 log entries, locked out 48 accounts badly enough that somebody must have noticed, and achieved nothing. The other produced no failed logins, no password prompts and no interactive sign-ins, and ended in Global Administrator.

This is why our earlier piece dwelt on ConnectWise's instruction to check the service principal sign-ins tab rather than the default one. The successful half of this campaign is invisible in the place people look.

Speed is the other number

Microsoft says that in several ARTEX-driven attacks "the time from initial targeting to privileged access was less than 3 hours".

Three hours is shorter than most organisations' time to notice, and considerably shorter than their time to decide. It is not a claim about a novel technique; password spraying and OAuth abuse are both old. It is a claim about throughput.

What ARTEX is

Microsoft calls it "an open-source penetration testing framework" that can drive any AI model: a multi-agent system written in Go with a web frontend, whose agents "run an autonomous penetration test from reconnaissance through data exfiltration" and record what they find in a graph. Output language is switchable between English, Korean, Mandarin, Spanish and Japanese.

We wrote about ARTEX earlier this month, when an operator's open directory held both the tooling and his own CV during attacks on South Korean financial firms. Its developer took it closed source on 8 October. Copies already downloaded are still in circulation, and Microsoft says it has seen multiple actors in several regions using it.

Microsoft also states plainly that none of this "result[ed] from a compromise of or a vulnerability in Microsoft corporate systems, products, or services".

What to do

  • Check service principal sign-ins, not user sign-ins, for every tenant you manage. That is where this shows and the default tab does not show it.
  • Review application credential changes and role assignments over the last three weeks, especially Global Administrator grants originating from an application rather than a person.
  • Treat lockout storms as a signal that something else is happening, not as the incident. Here the noisy campaign was the half that failed.
  • Inventory which third-party applications hold consent in your tenants and what each can reach. Consent granted once is the access being used.
  • If you are an MSP, the 2,250-plus tenant figure is a targeting count, not a victim count, and you cannot infer your status from it either way.

What is not established

  • How Storm-0940 got into ConnectWise in the first place. Microsoft does not describe it, and ConnectWise has said it is still working that out.
  • Whether the spray campaign and the ConnectWise compromise are the same operation. Microsoft's link rests on shared infrastructure rather than a stated causal path.
  • How many of the 2,250-plus tenants were actually compromised. No count has been published.
  • Whether customer data was accessed. Microsoft says the presence of an affected application or a successful authentication "does not necessarily indicate that customer data was accessed or exfiltrated".
  • The Korean financial-sector reporting on ARTEX, which Microsoft cites as public reporting rather than its own finding.