Storm-0940

☆ pin

Reports

First seen

Oct 21, 2026

Last seen

Oct 22, 2026

Motivation

Espionage

Targeting

Sectors

Other ×1

Top ATT&CK techniques

T1110 Brute Force ×3T1195 Supply Chain Compromise ×3T1041 Exfiltration Over C2 Channel ×2T1087 Account Discovery ×2T1078 Valid Accounts ×2T1098 Account Manipulation ×2T1098.001 Account Manipulation: Additional Cloud Credentials ×1T1005 Data from Local System ×1T1590 Gather Victim Network Information ×1T1595 Active Scanning ×1T1526 Enumerate Cloud Resources ×1T1592 Gather Victim Host Information ×1

Indicators

ip_v4 ×6filename ×1

Indicator values are available on Pro and via the API.

Recent reports

Critical

Microsoft attributes ConnectWise supply chain attack to Chinese state actor Storm-0940 using ARTEX AI agents

The Record (Recorded Future News)Oct 22, 2026 High

China-Linked Storm-0940 Exploits ConnectWise Supply Chain with ARTEX AI Agents

The Hacker NewsOct 22, 2026 High

Microsoft attributes ConnectWise supply-chain attack to China-state aligned Storm-0940

CyberScoopOct 21, 2026 Critical

Storm-0940 deploys ARTEX AI framework in large-scale supply chain compromise targeting hundreds of organizations

Microsoft Threat IntelligenceOct 21, 2026

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.