Microsoft says Storm-0940 targets organizations across multiple industries for data theft. Its tactical goals, as described by Microsoft, are:

• Gain initial access to cloud tenants at scale, including through compromised trusted third-party applications.
• Establish persistence in Microsoft 365 and Entra ID environments by adding credentials to existing OAuth applications, so access survives remediation of the original foothold.
• Reach privileged cloud access quickly. Microsoft observed multiple cases where the time from initial targeting to privileged access was under 3 hours.

Storm-0940 has historically used compromised applications to access and exfiltrate email and other data through Microsoft Graph. For the ConnectWise campaign, however, the presence of an affected application or a successful authentication does not by itself establish that customer data was accessed or exfiltrated.

Microsoft reported targeting across aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and nonprofit organizations.

• Password spraying against Microsoft 365 and Exchange Online accounts, historically and in the October 2026 cross-tenant campaign.
• Exploitation of internet-facing applications for initial access, followed by movement through the environment with compromised accounts.
• Supply chain compromise of multi-tenant OAuth applications, then authentication to downstream customer tenants as the vendor application, without an interactive user sign-in.
• OAuth application credential abuse: adding credentials to existing applications and service principals for persistence.
• Privilege escalation in Entra ID, including an application assigning itself a high-privilege role such as Global Administrator.
• Microsoft Graph and directory operations for reconnaissance and for changes to identities, groups and privileged roles.
• Microsoft Defender for Cloud detected bulk secret reads across multiple Azure Key Vaults using a compromised multi-tenant application’s trusted access. The available reporting does not establish that these reads occurred in every ConnectWise-affected tenant.
• Agentic AI tooling: ARTEX, an open-source multi-agent LLM framework written in Go with a Next.js frontend, that can use any AI model to run a penetration test from reconnaissance through data exfiltration with little human interaction.

In the October 2026 ConnectWise campaign, Microsoft describes the following pattern:

• Targeting at scale: Starting as early as September 2026, ARTEX was used against hundreds of organizations globally. Microsoft says the majority of targeting was not successful, but privileged cloud persistence was achieved at many organizations in a short time.
• Password-spray run (Oct. 10–14, 2026): Infrastructure at 144.172.64[.]99 sprayed 327 accounts across eight organizations, producing more than 151,000 failed logons, peaking at about 2,900 failures per minute on October 11. Microsoft observed no successful authentication in this run.
• Application credential abuse (from Oct. 15, 2026): Microsoft and Huntress associated different activity with addresses in the 144.172.64.0/24 range. Huntress identified 144.172.64[.]99 with the concentrated October 10–14 password spray and 144.172.64[.]128 with the primary vendor-application sign-ins. Huntress also reported a small number of failed user logins from 144.172.64[.]60.
• Follow-on activity: In some tenants, the agents moved from authentication to Graph and directory operations, including reconnaissance, application credential modifications, and changes involving identities, groups, and privileged roles.
• Persistence: Credential changes can remain active as a backdoor even after the original compromised application is remediated.