From RuntimeWire · RuntimeWire · · 40s
Microsoft Links ARTEX Attacks to 2,250 ConnectWise Tenants
Microsoft says China-aligned threat actor Storm-0940 exploited ConnectWise identities to attack 2,250 tenants.
In brief
Microsoft says China-aligned threat actor Storm-0940 exploited ConnectWise identities to attack 2,250 tenants. Microsoft reports China-linked group Storm-0940 used ARTEX to breach over 2,250 ConnectWise customer accounts. Originally reported by RuntimeWire.
Microsoft Reports ARTEX Attack
Microsoft says China-aligned threat actor Storm-0940 used ARTEX to exploit compromised ConnectWise application identities.
2,250 Tenants Affected
Activity peaked at 2,900 sign-in attempts per minute across more than 2,250 customer tenants.
Attack Timeline
The actor’s use of ARTEX was observed as early as September 2026, with activity peaking in October.
The one thing
Microsoft reports China-linked group Storm-0940 used ARTEX to breach over 2,250 ConnectWise customer accounts.
