Storm-0940

Also known as CovertNetwork-1658, ORB07

Storm-0940 is a Chinese threat actor active since at least 2021, known for gaining initial access through password spray and brute-force attacks, as well as exploiting network edge applications. Microsoft has observed Storm-0940 utilizing valid credentials obtained from CovertNetwork-1658's password spray operations, indicating a close operational relationship between the two. Once inside a victim environment, Storm-0940 has been seen leveraging compromised credentials for further malicious activities. Additionally, Storm-0940 has employed botnets, such as Quad7, to facilitate password spraying attacks.

Recent activity

• ---------------- 🎯 Threat Intelligence =================== Executive summary Todyl's MXDR team reports an ongoing identity incident that started on Novembe
  mastodon · Nov 6, 2026
• ---------------- 🎯 AI =================== Executive summary RST Labs' scan of 2 November 2026 counts more than 1,300 internet-facing consoles across three
  mastodon · Nov 4, 2026
• CrowdStrike OverWatch identified a VAPOR PANDA campaign using ARTEX alongside the Chinese-developed DeepSeek large language model (LLM) and a second commercial
  mastodon · Oct 30, 2026
• Storm-0940 used Artex to automate intrusions into ConnectWise customers' environments — the same AI-assisted playbook CrowdStrike, Zscaler, and Recorded Fut
  mastodon · Oct 27, 2026
• 🏆 New Achievement! By Using ConnectWise, You Agree to These Terms! Section 4, Paragraph 9 of the updated End-User Agreement: By continuing to operate a Connect
  mastodon · Oct 27, 2026
• Per HR Policy 9-1-1: by rotating service principal credentials after compromise, Storm-0940 ensured persistent access survived your remediation rituals. The gho
  mastodon · Oct 26, 2026
• 🏆 New Achievement! AI-Assisted Haunting, Full Benefits Package! Dear Valued Undead Stakeholder, we are pleased to inform you that Storm-0940, a China-linked th
  mastodon · Oct 26, 2026
• ⚠️ CRITICAL: Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants Chinese threat actor Storm-0940 exploited compromised ConnectWise
  mastodon · Oct 25, 2026
• 2026-W43 — Weekly Threat Roundup 🐚 PHP2Shell dominated the week: CVEs exploited before disclosure, millions of attempts, no confirmed compromises yet, but a th
  mastodon · Oct 25, 2026
• Nation-state actor Storm-0940 leveraged the AI-driven ARTEX framework to sprint through ConnectWise OAuth application abuse at machine speed, also hitting Korea
  mastodon · Oct 24, 2026
• Microsoft attributes Microsoft 365 intrusions to Storm-0940 using compromised ConnectWise app credentials with ARTEX agentic AI for access and actions. It shows
  mastodon · Oct 23, 2026
• A ConnectWise supply chain attack by Storm-0940 used the ARTEX AI platform to target over 2,250 Microsoft 365 environments. # Storm0940 # ARTEX # ConnectWise #
  mastodon · Oct 23, 2026

References

• https://www.microsoft.com/en-us/security/blog/2024/10/31/chinese-threat-actor-storm-0940-uses-credentials-from-password-spray-attacks-from-a-covert-network/

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.