kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · CN

Storm-0940

3 stories · 3 in the wild · October 22, 2026 – October 25, 2026

evidence: 2 observed · 1 attempted

how they got in

  • stolen credentials 1 · Oct 22

sectors

  • technology 3 · Oct 25
  • developers 1 · Oct 23

geography

  • china 3 · Oct 25

malware and tools

  • artex 2 · Oct 25

techniques

  • credential access 3 · Oct 25
  • persistence 2 · Oct 25
  • authentication bypass 1 · Oct 25
  • mfa bypass 1 · Oct 23
  • password spraying 1 · Oct 23
  • defense evasion 1 · Oct 22
  • discovery 1 · Oct 22
  • lateral movement 1 · Oct 22
  • privilege escalation 1 · Oct 22

attack phases seen

  • Initial access 3 · Oct 25
  • Discovery 2 · Oct 25
  • Persistence 2 · Oct 25
  • Execution 1 · Oct 25
  • Credential access 1 · Oct 23
  • Privilege escalation 1 · Oct 22

what we reported, newest first, grouped by story

Oct 18 – October 25, 2026 · 3 reports

  • Storm-0940 drove the ConnectWise intrusions with the open-source AI pentest framework ARTEX at machine speed. Microsoft says the China-linked actor hit over 300 accounts across eight organisations at more than 2,900 attempts per minute, then used ARTEX to attempt sign-ins to more than 2,250 tenants, generating 151,000+ failed logon events. In some environments the agents progressed past authentication into Microsoft Graph and directory operations — reconnaissance, application credential modification for persistence, and changes to identities, groups and privileged roles, ensuring access survives remediation of the original app. (SecurityWeek) · Oct 25 · observed · Threat Activity
  • ARTEX-driven intrusions extend well past ConnectWise. Wiz documents activity across multiple IT and software vendors during October overlapping Microsoft's Storm-0940 findings: password spraying against Okta and Entra, probing of account recovery, SSO and cross-tenant access, Cognito flows tested, and sessions running 24–30 hours with address or endpoint rotation when blocked. Most attempts failed — this is sustained targeting, not a confirmed mass breach. Microsoft says the China-aligned actor hit more than 2,200 tenants and in multiple instances went from initial targeting to privileged access in under three hours (earlier coverage). Wiz, The Record · Oct 23 · attempted · Threat Activity
  • Microsoft now assesses that China-aligned Storm-0940 conducted the ConnectWise Cloud Backup compromise using ARTEX. Since September, the actor targeted hundreds of organizations globally; several attacks reached privileged cloud access, and multiple did so in under three hours. ARTEX used compromised, previously consented application credentials to enter Microsoft 365 without an interactive sign-in, followed by Graph reconnaissance, credential changes and privilege attempts. Successful authentication does not itself prove data access or exfiltration. The attribution and agentic workflow are new since earlier coverage; see Microsoft’s analysis. · Oct 22 · observed · via stolen credentials · Cloud, Identity & Threat Activity