Microsoft Threat Intelligence published its assessment of the ConnectWise Cloud Backup compromise on October 21, 2026, attributing it to Storm-0940, a China-linked espionage group, and saying the group used an AI agent framework called ARTEX to run its activity at machine speed. The incident is a useful case study because it separates two questions that headlines tend to merge: how the attackers got in, and what AI changed once they were inside.
What happened, in order
The public record comes from Microsoft's report, ConnectWise's advisories and security vendors that saw the activity in customer environments. Where figures differ between sources, this post says so.
| Date (2026) | Event | Source |
|---|---|---|
| Oct 10 to 14 | More than 151,000 failed sign-in attempts against 327 accounts at eight organizations (password spraying, no successful logins) | Microsoft, via The Register |
| Oct 13 to 14 | Scripted sign-in attempts from a single IP address using a curl user agent | Huntress, via BleepingComputer |
| Oct 15 | Malicious activity begins, including a service principal assigning itself an Exchange Administrator role in one reported case | BleepingComputer |
| Oct 17 | ConnectWise announces a Cloud Backup interruption and disables seven application identities | BleepingComputer |
| Oct 18 | Cloud Backup still unavailable, SaaS Security and Cloud Management offline as a precaution | BleepingComputer |
| Oct 21 | Microsoft attributes the activity to Storm-0940 and names ARTEX | Microsoft, via The Register and TechCrunch |
The entry point was a vendor credential, not an AI breakthrough
According to The Register's summary of Microsoft's report, the password spraying produced no successful logins. The attackers then switched to compromised ConnectWise application credentials, which let them act with permissions that customers had already granted to ConnectWise services, without an interactive user login. BleepingComputer's account adds that the sign-ins were automated and involved no user login, so multi-factor authentication did not apply, and that Microsoft assessed the attacker likely abused existing permissions including Directory.ReadWrite.All.
That sequence matters for how to read the AI claim. The decisive step was possession of an application secret, which is a classic supply chain failure. What reporting says is unknown is how the attacker obtained the vendor credentials. ARTEX appears in the story as the engine that scaled what came next.
AI did not supply the key. It changed how fast the attacker could try every door the key opened.
What ARTEX is, and what Microsoft says it did
The Register describes ARTEX as a freely available open-source penetration-testing framework written in Go that uses AI agents, and says Microsoft observed Storm-0940 using it as early as September. TechCrunch describes it as an open-source framework that works with AI models to stress-test cyber defenses, and reports that the same software was used in a recent compromise of South Korea's financial systems. We covered that earlier case in South Korean bank breaches and the AI hacking probe. Microsoft says attackers from several regions are using ARTEX.
The measurable effect Microsoft cites is tempo:
- More than 2,250 Microsoft 365 tenants had authentication attempted against them.
- At times the rate reached about 2,900 attempts per minute (TechCrunch rounds this to almost 3,000).
- In some cases the group moved from targeting to privileged cloud access in under three hours.
The ConnectWise incident at three different scales
Each bar counts a different thing, from password spraying to attempted sign-ins, so read them as stages rather than a single total.
Sources: Microsoft via The Register (8 organizations, 2,250 tenants targeted); Huntress via BleepingComputer (at least 162 tenants). Total compromised is not disclosed.
The chart above compares three counts that measure different things, so it should not be read as a funnel with a conversion rate. Microsoft's 2,250 is the number of tenants targeted. Huntress's 162 is the number it confirmed compromised within its own customer base. Microsoft has not disclosed how many customers were compromised overall or whether data was stolen.
Why application identities are a different kind of risk
Most organisations design access controls around people: passwords, MFA prompts, conditional access. An application identity authenticates with a secret or certificate, and the permissions behind it were typically approved once, by an administrator, for a legitimate vendor purpose. The incident shows how the three properties combine:
| Property | Effect in this incident |
|---|---|
| Granted once, broadly | Permissions customers had already approved were reusable by anyone holding the secret |
| No interactive login | MFA and user-focused prompts never triggered |
| Survives user changes | Per Todyl via BleepingComputer, revoking user sessions does not end application-based access |
| Multi-tenant | One compromised vendor identity touched thousands of tenants, not one |
Microsoft also observed activity in Microsoft Graph consistent with reconnaissance, application credential changes and attempts to modify privileges, which could let attackers persist after the original credentials are revoked. Huntress reported a tenant where persistence took about five minutes. ConnectWise CEO Manny Rivelo acknowledged that shutting down connections would not necessarily remove attackers already inside customer environments.
What defenders were told to check
The mitigation advice in the public coverage is concrete and largely identity-focused:
- Review service principal sign-ins filtered by the Cloud Backup application ID, looking for unexpected source addresses (ConnectWise guidance, via BleepingComputer).
- Review application credential changes, OAuth grants and related Graph activity (Microsoft).
- Disable the implicated ConnectWise applications, check for unauthorised credentials, and review secrets and certificates added since October 13 (Huntress).
- Remember that disabling an app stops new token issuance but existing tokens stay valid until they expire (Todyl).
ConnectWise said there were no indicators that partner backup data was compromised and that existing archives were not affected, and that its outage does not by itself indicate a customer environment was compromised.
Analysis: three takeaways that are less obvious than the headline
1. The defender's clock now matters more than the attacker's cleverness. If privileged access can follow targeting in under three hours, detection and credential revocation windows measured in days no longer hold. This is a tempo argument, not a claim that the attacks were novel.
2. Vendor concentration is the amplifier. A managed-service ecosystem concentrates trust in a few multi-tenant applications. A single leaked secret turned into an attempt against 2,250 tenants. The same logic appears in agent platforms, where one integration credential can span many users, a theme we explored in the agent hacker that tested 100 sites.
3. Attribution and counts will keep moving. Early numbers ranged from 162 to 2,250 depending on what was counted, and Microsoft has not said how many tenants were breached. Treat any single figure as provisional.
For teams running AI assistants and automation, the lesson transfers directly. Integrations should hold the narrowest scopes they need, secrets should live in a vault rather than in agent context, and every connection should be inventoried so it can be revoked quickly. Multi-model workspaces such as Metir keep credentials out of what the model sees for the same reason, though no tool removes the need to audit the permissions granted to third parties.
MicrosoftWhat to watch next
- Disclosure of victim counts. Microsoft has not said how many customers were compromised.
- How the vendor credentials were obtained. Reporting lists this as unknown.
- Restoration timeline and regulatory filings. ConnectWise was gradually restoring services as of October 22.
- Further ARTEX use. Microsoft says multiple actors use it, so similar tempo should be expected elsewhere.
Sources:
- Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants (The Register)
- Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise (TechCrunch)
- Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack (BleepingComputer)
- ConnectWise launches AI platform for managed service providers (TBBW Magazine, for the company's Tampa base)
Image credits
- Hero and in-body photo: "Downtown Tampa, Florida.jpg" by Clément Bardot, licensed CC BY-SA 4.0, via Wikimedia Commons. Pulled 2026-10-23 and reviewed visually before use.