# Microsoft Links ARTEX Attacks to 2,250 ConnectWise Tenants

> Microsoft says China-aligned threat actor Storm-0940 exploited ConnectWise identities to attack 2,250 tenants.
- Title: Microsoft Links ARTEX Attacks to 2,250 ConnectWise Tenants
- Summary: Microsoft says China-aligned threat actor Storm-0940 exploited ConnectWise identities to attack 2,250 tenants. Microsoft reports China-linked group…
- Keywords: microsoft, connectwise, storm-0940, artex, tenants, cloud security, technology, Links, Attacks, 250, RuntimeWire
- Source: RuntimeWire — https://runtimewire.com/article/storm-0940-artex-connectwise-oauth-attack
- Author: RuntimeWire
- Published: 2026-10-22T00:43:24.469+00:00
- Read time: 1 min
- Topics: microsoft, connectwise, storm-0940, artex, tenants, cloud security, technology, ai
## Microsoft Reports ARTEX Attack
Microsoft says China-aligned threat actor Storm-0940 used ARTEX to exploit compromised ConnectWise application identities.
## 2,250 Tenants Affected
Activity peaked at 2,900 sign-in attempts per minute across more than 2,250 customer tenants.
## Attack Timeline
The actor’s use of ARTEX was observed as early as September 2026, with activity peaking in October.
## Key takeaway

Microsoft reports China-linked group Storm-0940 used ARTEX to breach over 2,250 ConnectWise customer accounts.