Storm-0940Threat actor
- covertnetwork-1658
- orb07
Storm-0940 is a Chinese threat actor active since at least 2021, known for gaining initial access through password spray and brute-force attacks, as well as exploiting network edge applications. Microsoft has observed Storm-0940 utilizing valid credentials obtained from CovertNetwork-1658's password spray operations, indicating a close operational relationship between the two.From MISP Galaxy
Last reported yesterday, by SecurityWeek9 reports
ATT&CK techniques
6 of 12 · each with the sentence it comes from- T1110.003Password Spraying
“Tracked as Storm-0940 and active since at least 2021, the APT is known for relying on password spraying and the exploitation of vulnerable internet-facing applications to hack into organizations across multiple sectors.”
- T1195Supply Chain Compromise
“Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application.”
- T1552.004Private Keys
“Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys”
- T1078.004Cloud Accounts
“T1078.004 Valid Accounts: Cloud Accounts | Using compromised cloud accounts to obtain access.”
- T1087.004Cloud Account
“T1087.004 Account Discovery: Cloud Account | Identifying privileged cloud accounts for further targeting.”
- T1098Account Manipulation
“T1098.003 Account Manipulation: Additional Cloud Roles | Addition of privileged cloud role assignments, including self assignment of global admin from one of the ConnectWise Management Application.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
9 reports, newest first · the exact sentence from each-
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks“Tracked as Storm-0940 and active since at least 2021, the APT is known for relying on password spraying and the exploitation of vulnerable internet-facing applications to hack into organizations across multiple sectors.”
-
Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies“Storm-0940 deploys ARTEX AI agents in hacking spree: Microsoft says that a Chinese state-aligned group is responsible for the ConnectWise Cloud Backup hack last week.”
-
Microsoft Links ConnectWise Breach to China-Linked Group Using AI Pentesting Tool ARTEX“China-linked Storm-0940 used AI tool ARTEX to target 2,250 Microsoft 365 tenants, exploiting stolen ConnectWise credentials at machine speed.”
-
Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack“Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack”
-
Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants“The Windows giant revealed this week that the attackers, tracked as Storm-0940, used an open source AI penetration-testing tool called ARTEX to automate attacks against Microsoft 365 environments.”
-
Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants“Microsoft assessed that a threat actor, tracked as Storm-0940, utilized agentic AI penetration testing framework ARTEX to target hundreds of organizations globally across a broad range of industries, beginning in September 2026.”
-
China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack“Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application.”
-
Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group“…ent supply-chain attack targeting ConnectWise customers’ Microsoft 365 environments to a China-state aligned threat actor it tracks as Storm-0940.”
-
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise“As early as September 2026, Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries.”
Indicators in its reports
named in the reports above- 144.172.64[.]99in 3 reports
- railway[.]comin 1 report
- pylos[.]coin 1 report
- infosec[.]exchangein 1 report
- 144.172.64[.]128in 1 report
- 144.172.64[.]60in 1 report
- 187.15.88[.]186in 1 report
- 187.15.90[.]217in 1 report
- 187.15.89[.]186in 1 report
- masto.deoan[.]orgin 1 report
- sheogorath.bsky[.]socialin 1 report
- chaos[.]socialin 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.