China-aligned Storm-0940 used ARTEX AI agents and a stolen ConnectWise credential to breach Microsoft 365 tenants
Microsoft Threat Intelligence attributed a campaign to Storm-0940, a China-state-aligned threat actor, which used the agentic AI penetration-testing framework ARTEX to automate attacks on Microsoft cloud environments. An ARTEX-powered password-spray phase from October 10 to 14 produced more than 150,000 failed sign-ins and no successful logins. ARTEX agents then used stolen ConnectWise Cloud Backup application credentials to attempt sign-ins to more than 2,250 downstream customer tenants at 2,900 attempts per minute. This bypassed multi-factor authentication because the app signs in with its own credential. Some organisations saw unauthorised cloud access within three hours. Huntress reported unauthorized access in about 300 tenants, though it cautioned that a successful sign-in does not always mean access. In about 50 tenants, ConnectWise service principals assigned themselves directory roles. In at least one environment, an app gave itself the Global Administrator role and backdoor credentials valid until 2028 were planted. ConnectWise suspended the affected services on October 17, and Microsoft and Huntress issued remediation guidance.
What the AI did
A China-state-aligned group, Storm-0940, used ARTEX, an open-source AI agent tool built to automate break-in testing, to automate attacks on Microsoft cloud accounts. After a failed password-guessing phase, the ARTEX agents used stolen ConnectWise Cloud Backup app credentials to try to sign in to more than 2,250 downstream customer tenants (an organisation's own Microsoft cloud setup) at machine speed. In some tenants the agents gained access, changed app credentials and took admin roles.
First reported October 16, 2026 · Added to the register November 1, 2026 · 5 sources
- Tenants with confirmed unauthorized access
- 300
- Developer
- Autumn-27 (China)
- Deployer
- Storm-0940
- Model
- ARTEX
- Affected
- ConnectWise Cloud Backup customer tenants, Huntress
- When it happened
- October 10, 2026
- First reported
- October 16, 2026
What this means for you
Could this affect you?
If your Microsoft cloud tenant has approved ConnectWise Cloud Backup (formerly SkyKick) or related ConnectWise apps, or you are a provider managing such tenants. Organisations that had approved ConnectWise Cloud Backup or related ConnectWise apps in Microsoft's cloud were exposed, and so were the IT service providers that manage them. Huntress reported unauthorized access in about 300 tenants. In one environment, Huntress's own security platform was among the apps given hidden backdoor logins.
What to check
- Keep ConnectWise app connections disabled.
- Search Microsoft Entra, Microsoft's sign-in service, for the listed application IDs, and check app sign-ins since October 1 for the named attacker IP addresses and user agents.
- Audit for new credentials or self-assigned admin roles before deleting anything.
- Limit what multi-tenant connected apps can do, and monitor activity apps perform on their own.
Areas of your AI programme this touches
Timeline
- October 10, 2026Happened
- October 16, 2026First reported
- October 22, 2026Microsoft said some organisations saw unauthorised cloud access within three hours of initial targeting, and that in one case an application assigned itself the Global Administrator role. Microsoft said the activity was part of a campaign that began around September 2026.[1]
- October 22, 2026Microsoft said Storm-0940 used Artex to attempt to sign in to more than 2,250 tenants at 2,900 sign-in attempts per minute. Microsoft also described an Artex-powered password-spraying campaign between Oct. 10 and Oct. 14 that targeted over 300 accounts across eight organizations and resulted in more than 150,000 failed logon events.[5]
- October 22, 2026ConnectWise CTO David Raissipour said the company is aiming by the end of this week to restore MSP access to ConnectWise Cloud Backup for Microsoft 365 and other services suspended on October 17. Microsoft said Storm-0940's use of ARTEX did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services.[4]
- October 22, 2026Microsoft advised customers to keep affected ConnectWise connections disabled until ConnectWise issues restoration instructions and not to delete enterprise applications as a first step, and said organizations should search tenants by the four affected application IDs rather than display names.[2]
Every fact and its source (18)
- Supply-chain pivot windowOctober 15, 06:13–08:34 UTC“between 06:13 and 08:34 UTC on October 15”[3]
- Campaign startAround September 2026“the activity was part of a campaign that began around September 2026”[1]
- Password-spraying campaign periodOct. 10 to Oct. 14“Between Oct. 10 and Oct. 14”[5]
- ConnectWise services suspendedOctober 17“services that were suspended on October 17 in the wake of the security breach”[4]
- Failed sign-ins in password-spray phasemore than 151,000“Microsoft telemetry captured more than 151,000 failed sign-in events over the period”[3]
- Backdoor credential validityuntil 2028“creating credentials that would remain valid until 2028”[3]
- Targeted national security sector tenants16“a second, more targeted wave of attempts against 16 national security sector tenants”[3]
- ConnectWise responseSuspended all affected services“ConnectWise suspended all affected services by 07:00 UTC on October 17”[3]
- Tenants with self-assigned directory rolesabout 50“In about 50 tenants lost directory roles to ConnectWise service principals”[3]
- Speed of compromiseUnauthorised cloud access within three hours of initial targeting“Microsoft said some organisations experienced unauthorised cloud access within three hours of initial targeting.”[1]
- Privilege escalationAn application assigned itself the Global Administrator role“In one instance, an application assigned itself the Global Administrator role”[1]
- ConnectWise disclosureAdvisory on unauthorised access attempts in Cloud Backup environment, October 16“ConnectWise disclosed attempts at unauthorised access in its Cloud Backup environment in an advisory published on October 16.”[1]
- Password-spraying targetsOver 300 accounts across eight organizations“targeting over 300 accounts across eight organizations”[5]
- Failed logon eventsMore than 150,000“resulted in more than 150,000 failed logon events”[5]
- Tenants targeted after the ConnectWise accessMore than 2,250 tenants at 2,900 sign-in attempts per minute“attempt to sign-in to more than 2,250 tenants at 2,900 sign-in attempts per minute”[5]
- ConnectWise responseAiming to restore MSP access by end of week“ConnectWise is aiming by the end of this week to provide thousands of its MSPs with access once again”[4]
- Microsoft finding on its own systemsNo Microsoft vulnerability involved“did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services”[4]
- OutcomeMost targeting unsuccessful but privileged persistence at many organizations“Most of the targeting was unsuccessful, the company said, but the group achieved privileged cloud persistence at many organizations in a short time.”[2]
Sources
- AI Powered hackers, 2,900 attempts a minute: Microsoft blames China linked group for AI assisted ConnectWise cyberattackbusinesstoday.in · October 22, 2026
- China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenantscsoonline.com · October 22, 2026
- China's AI Agent Hacked 2,250 Microsoft 365 Tenants in Hours; MFA Didn't Applytechtimes.com · October 22, 2026
- China State-Aligned Group Storm-0940 Used Agentic AI At Rate Of 2,900 Sign-In Attempts Per Minute In ConnectWise Breachcrn.com · October 22, 2026
- China-Aligned Hackers Used Agentic AI to Target ConnectWisegovinfosecurity.com · October 22, 2026
How this record is classified. Severity C (5/5): real harm at scale, or an autonomous system acting against people or institutions. OECD level: serious incident, an event in which an AI system led to serious harm. Evidence: Confirmed, meaning a company, official or court statement.
The facts in At a glance and in Every fact and its source are quoted from the sources listed. The summary, What the AI did and What this means for you are written from those sources and checked against them automatically before publication. Records reflect what has been disclosed, not everything that has happened. Incidents are found through news feeds and the GDELT Project.
