Storm-0940

Summary

China-state aligned espionage actor tracked only by Microsoft, with no known industry aliases, active since 2021. Its long-standing pattern is initial access through password spraying and brute force, or through exploited or misused network-edge services, then lateral movement with scanning and credential-dumping tools (T1110.003, T1190, T1046, T1003). In 2024 Microsoft observed it entering targets with valid credentials harvested by CovertNetwork-1658 (Quad7 / xlogin), a network of compromised SOHO routers that runs very-low-volume password sprays, against think tanks, government bodies, NGOs, law firms and the defence industrial base in North America and Europe. In cloud tenants it persists by adding credentials to existing OAuth applications and pulls mail and data through Microsoft Graph (T1098.001, T1114.002). From September 2026 Microsoft saw it drive the open-source agentic AI penetration-testing framework ARTEX against hundreds of organisations worldwide (T1588.007), at times reaching privileged cloud access within three hours. Microsoft assesses that Storm-0940 was behind the October 2026 ConnectWise multi-tenant application compromise, after which it attempted sign-ins to more than 2,250 downstream tenants through the application's existing trust (T1199). The attribution rests on Microsoft's reporting alone.

Attribution

Single-vendor reporting (Microsoft); no service named

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• Microsoft Threat Intelligence (Research, 2026-10-21)
  A China-state aligned actor, active since 2021, with no known industry aliases
• Microsoft Threat Intelligence (Research, 2024-10-31)
  Tracked as a Chinese threat actor using CovertNetwork-1658 credentials

Campaigns 3

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 9

Infrastructure patterns

• Credentials from CovertNetwork-1658 (Quad7), compromised SOHO routers doing password sprays (Microsoft, 2024)
• Cross-tenant password spray from 144.172.64[.]99, 10–14 Oct 2026 (Microsoft, 2026)

Reporting and advisories 2

• Microsoft Threat Intelligence
  Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network (31 Oct 2024)
• Microsoft Threat Intelligence
  AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (21 Oct 2026)