WORLD WATCH · October 21, 2026 · NEWS
ConnectWise supply-chain attack linked to Storm-0940
Microsoft links a ConnectWise supply-chain attack to Storm-0940.
- Reported by
- CyberScoop
- Outlets reporting
- 1
- Category
- NEWS
- Newest report
- October 21, 2026
Plain-English brief. Written for readers who work in a second language.
Key takeaways
- Storm-0940 is China-state aligned.
- Attack targeted the ConnectWise supply chain.
- Use of an agentic AI framework was reported.
What happened
The report comes from CyberScoop. Microsoft pinned the ConnectWise supply-chain attack to Storm-0940. Storm-0940 used an agentic AI penetration testing framework to automate attacks. Storm-0940 reached more than 2,250 tenants. Storm-0940 made 2,900 sign-in attempts per minute.
Why it matters
Storm-0940 is a China-state aligned threat group. The attack used automation to scale sign-in attempts. The scale affected more than 2,250 ConnectWise tenants.
What to do
- Review ConnectWise access logs for unusual sign-in activity.
- Restrict sign-in permissions for exposed ConnectWise accounts.
- Verify access controls for accounts linked to ConnectWise integration.
SOURCE: INTEL128 WORLD WATCH (UPDATED OCT 21, 2026). This brief summarizes reporting by CyberScoop. Intel128 writes the summary and credits the outlet. Read the summary as a starting point, not as a substitute for the original reporting.