- Published
- Source
- Security Affairs
- Reported by
- 2 publishers
- Filed under
- Data breaches, Nation-state, Microsoft
China-linked Storm-0940 used AI tool ARTEX to target 2,250 Microsoft 365 tenants, exploiting stolen ConnectWise credentials at machine speed. Microsoft published a detailed technical report naming Storm-0940, a China state-aligned group, as the actor behind the ConnectWise Cloud Backup supply chain compromise. The group used ARTEX, an open-source AI-driven penetration testing framework, to run attacks…
Think your details were in it?
- Check your email address at Have I Been Pwned – it lists the breaches your details have appeared in.
- Change that service's password, and any other account that used the same one. A password manager makes every password unique.
- Turn on two-step verification, and expect scam messages that quote the leaked details to sound convincing.
More helpHave I Been Pwned (opens in a new tab)NCSC: top tips for staying secure online (opens in a new tab)
Also reported by 1 more publisher
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
Supply Chain Compromise
Initial AccessWhat a defender checks
- Find where the affected package, update or vendor is used in your estate.
- Pin and verify dependencies, and keep a software bill of materials.
- Review what access the vendor's software has.
Build the skillBlue Team Engineer · Risk Assessment & Recommendations Reporting
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Blue Team Analyst
Every story here started as an alert. Learn to triage them.
Our Blue Team Analyst programme prepares you for a first SOC role: 26 live classes in UK hours, an alert queue worked in Microsoft Sentinel, and a full SOC shift simulation at the end. No security experience needed to start.
- Triage and KQL in Microsoft Sentinel
- Identity, endpoint, email and network investigations
- A verifiable digital badge
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
