Microsoft says that between October 10 and 14, 2026, Storm-0940 infrastructure ran a password-spray campaign against 327 accounts across eight organizations, with 151,000+ failed logon events, and no successful authentication was observed.

The exact words it rests on

Between October 10 and 14, 2026, Storm-0940 infrastructure at 144.172.64[.]99 conducted an automated cross-tenant password-spray campaign targeting 327 accounts across eight organizations ... Microsoft telemetry captured 151,000+ failed logon events ... Despite the scale, no successful authentication, token issuance, Graph call, or directory change was observed.

What the source said when we opened it, on 24 Oct 2026.

The source

AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Microsoft Security Blog · 2026-10-21

Open the sourcearchived copy

Checked

Checked by the notis newsroom on 24 Oct 2026, against the source above.

In the story

Microsoft says Storm-0940 used the ARTEX agent framework in the ConnectWise compromise; it names no AI model 24 Oct 2026