Microsoft Says China-Aligned Hackers Used AI Agents After Breaching ConnectWise Cloud Backup

Microsoft said on October 21, 2026 that Storm-0940, a hacking group it describes as China-state aligned, was behind the recent breach of ConnectWise's Cloud Backup service and used an open source AI agent framework called ARTEX to exploit it. With stolen ConnectWise application credentials, the group's agents tried to sign in to more than 2,250 Microsoft 365 tenants, and several attacks reached privileged access less than 3 hours after targeting began, Microsoft said in its threat intelligence report.

ConnectWise sells IT management and remote access software, and its Cloud Backup app holds standing permissions inside its customers' Microsoft 365 tenants, so one compromised app can reach many of them. The case is one of the most detailed public accounts so far of AI agents, software that carries out multistep tasks with little human input, used in a real supply chain attack. It follows an October 19 report by The Verge on findings from security firm Norforge that a hacker used mostly autonomous agents to break into more than 100 websites.

What did Microsoft say happened?

Microsoft Threat Intelligence said on October 21, 2026 that Storm-0940 took control of the identities of several ConnectWise cloud applications and then used ARTEX to speed up scanning, password spraying and abuse of OAuth applications at downstream victims. An OAuth application is a third party app that a company has granted access to its Microsoft 365 data; signing in as the app needs no interactive user login.

In multiple environments the agents moved on to Microsoft Graph, the API that reads and changes Microsoft 365 data, for reconnaissance, application credential changes and attempts to change privileges, according to Microsoft. Security firm Huntress saw one ConnectWise app add itself to the Global Administrator role on October 15 and plant new secrets set to expire in 2028.

Microsoft also tied an earlier password spray to the same infrastructure. Between October 10 and 14, an address in the 144.172.64.x range produced more than 151,000 failed sign-ins against 327 accounts at eight organizations, peaking at 2,900 failures per minute on October 11, with no successful authentication. ConnectWise's advisory of October 16 listed an IP address that exactly matched the one behind the spray, Microsoft said.

Microsoft says the activity did not result from a compromise of, or a vulnerability in, its own systems or products. It says most of the targeting failed, but that the group still gained privileged, persistent cloud access at many organizations in a short time.

What is ARTEX, and who else is using it?

ARTEX is an open source penetration testing framework that runs a team of AI agents through an attack from reconnaissance to data exfiltration with little human involvement, and Microsoft says it can work with any AI model. Penetration testing is authorized hacking that companies pay for to find their own weaknesses.

Microsoft says it has seen threat actors in multiple regions using ARTEX. Agents work around the clock and try several paths at once, the company argues, which leaves defenders little time to act on the alerts their traffic generates.

The same tool turned up in a very different case. CrowdStrike reported on October 7, 2026 that an unattributed actor, likely a Chinese speaker and financially motivated in its assessment, used ARTEX against South Korean financial organizations from late September to early October. That actor ran ARTEX on DeepSeek v4.1-flash and also used Claude Code, according to files CrowdStrike found on exposed servers. Read together, the two reports put one open source agent framework in the hands of a state aligned espionage group and a financially motivated actor in the same month.

How many ConnectWise customers were affected?

No source has published a final count of compromised customers: Microsoft counts attempted sign-ins at more than 2,250 tenants, while Huntress counts the successful sign-ins it could confirm. The figures come from different vantage points and should not be added up.

TechCrunch summarized Microsoft's findings as the hackers using AI agents "to rapidly hack into around 2,250 organizations." Microsoft's own wording is narrower: attempted sign-ins, and it says even a successful sign-in does not necessarily mean data was accessed or taken. Huntress says it has not confirmed data impact and found no evidence of mailbox or file manipulation in the two compromised tenants it reviewed closely, while noting that Microsoft Graph directory reads leave no audit record.

What should ConnectWise customers do now?

Microsoft advises keeping affected ConnectWise app connections disabled until ConnectWise issues formal restoration instructions, and preserving evidence before deleting any enterprise application. It recommends reviewing activity from at least October 15, 2026, and app sign-ins back to October 1 where logs allow, including credential additions and privileged role assignments.

ConnectWise suspended Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management as a precaution, has started a phased restoration expected to take several days, and has no indicators to date that partner backup data was compromised (ConnectWise via Tom's Hardware). Huntress likewise advises against re-enabling the affected apps until ConnectWise confirms all credentials were reset. Microsoft warns that credentials the attackers added to other apps can keep working as a backdoor even after the original ConnectWise app is fixed.

What we don't know yet

• How Storm-0940 obtained the ConnectWise application credentials in the first place.
• How many tenants were actually compromised, and whether any customer email or files were taken.
• Which AI model or models Storm-0940 ran ARTEX with.
• How ConnectWise's own investigation attributes the breach, and when all suspended services will be fully restored.