Microsoft ties the ConnectWise compromise to Storm-0940, which automates attacks with ARTEX agentic AI
On October 21, 2026, Microsoft attributed the ConnectWise Cloud Backup compromise to Storm-0940, a China-state aligned actor using the ARTEX agentic AI framework to go from targeting to privileged access in under three hours. Reduce multi-tenant application permissions and treat service-principal sign-ins as a first-class alert signal.