Verified reporting · vendor/source-attributed
- Microsoft reported Storm-0940 activity using ARTEX to attempt sign-ins across more than 2,250 downstream tenants. That figure is not a count of confirmed compromises.
- Microsoft identified follow-on Graph and directory operations in multiple customer environments, while warning that an affected application or successful sign-in does not alone establish unauthorized data access or exfiltration.
- In its 24 October advisory, ConnectWise distinguished phased service restoration and security validation from continuing investigation of individual Microsoft 365 environments.
E2E research question
What separate evidence is needed to support claims of attempted access, confirmed unauthorized action, containment, and recovery?
Conditional EG intersection
Where a governed operation occurred, was that specific operation supported by valid authority? This differs from whether its downstream effects have been remediated.
Claim boundary and limitations
Do not infer that all 2,250+ tenants were compromised, that all data was exfiltrated, or that restoring a service completes every customer investigation.
Vendor announcements and study reports illustrate research problems, not empirical validation or adoption of E2E/EG.
Primary sources
Related published research