ConnectWise breach: Microsoft says Chinese hackers used ARTEX AI on 2,250 tenants

The ConnectWise breach has turned into one of the clearest examples yet of an AI agent doing a hacker's busywork at machine speed. Microsoft says a China state aligned group it tracks as Storm-0940 took over cloud app identities belonging to ConnectWise, a widely used IT management vendor, and then pointed an open source agentic tool called ARTEX at more than 2,250 Microsoft 365 tenants. In some cases, the company says, the attackers went from first targeting to privileged cloud access in under three hours.

Microsoft laid out the campaign in a Security Blog post published October 21. Since then, outlets including The Register, CyberScoop and CSO Online have added detail on the fallout at ConnectWise and on how much of the work was handed to software rather than people.

What happened in the ConnectWise breach

The timeline starts earlier in October. According to Microsoft, Storm-0940 ran a password spray between October 10 and October 14 from a single IP address. That spray targeted 327 accounts at eight organizations and produced more than 151,000 failed logons. It peaked on October 11, when Microsoft counted up to 2,900 failed attempts per minute and more than 111,000 failures for the day. About 98% of the responses were account lockouts, and Microsoft says not one of those attempts succeeded.

The real damage came through a side door. Security firm Huntress reported a compromise of ConnectWise Cloud Backup on October 15, and ConnectWise published its own advisory on October 16. That advisory listed an IP address that matched the one Microsoft had tied to the spray.

Microsoft says the attackers gained control of the identities behind several ConnectWise cloud applications, including Cloud Backup and apps connected to Microsoft Teams and Microsoft Graph. Those apps were already trusted inside customer tenants, because businesses had consented to them in order to use ConnectWise products. With that access, Storm-0940 used ARTEX to attempt sign ins to more than 2,250 tenants.

No password, no MFA prompt

This is the part that should worry IT teams. The sign ins were app only. In Microsoft's words, they happened "without requiring an interactive user sign-in." Because the attackers were acting as an already approved application (what Microsoft calls a service principal), user multifactor authentication never came into play. Nobody got a push notification to deny.

Once inside, Microsoft says the activity included reconnaissance through Graph and the directory, changes to app credentials to keep access, and changes to identities, groups and privileged roles. In one case, Microsoft Defender flagged an alert titled "Application self-assigned Global Administrator role," which is about as bad as it sounds.

What ARTEX is and why it matters

ARTEX is not a custom piece of state malware. Microsoft describes it as an open source agentic penetration testing framework that can work with any AI model. It is a multi agent system built around large language models, written in Go with a Next.js interface, and its agents can carry an operation from reconnaissance through data exfiltration "with little human interaction."

Microsoft says Storm-0940 has used ARTEX since at least September 2026 against hundreds of organizations, and that several different actors in multiple regions use it. Public reporting earlier in October also linked the tool to breaches at Korean financial institutions. CSO Online described ARTEX as a Chinese tool, but Microsoft's post does not say where it came from.

Igor Tsyganskiy, an executive vice president at Microsoft, put the episode in a wider frame. "Since early October, a wave of AI-driven cyberattacks has been ongoing," he wrote on LinkedIn, according to CyberScoop, calling the ConnectWise attack "one of many."

The speed is the story. Analysts quoted by CSO Online said defenders built their processes around human attackers who need time to look around. Yih Khai Wong of IDC said the timeline "is not a timeline any human analyst queue can keep up with," adding that "relying on a human to click 'approve' will not cut it."

We have covered how attackers are using automation before, including Anthropic's warning about AI worms spreading across smart devices. The ConnectWise case is a concrete, documented example of that shift in a corporate cloud.

Who is affected

The most exposed groups are organizations that connected ConnectWise cloud products to their Microsoft 365 tenants, and the managed service providers who run those tools for clients. Microsoft says Storm-0940's broader campaign has focused on sectors such as aerospace, defense and finance, but none of the reports we read break down the 2,250 tenants by industry.

It is also not clear how many organizations were actually compromised. Most attempts failed, but The Register reports that the attackers achieved privileged persistence at "numerous" organizations. Microsoft has not shared a victim count or said whether data was stolen. As CSO Online notes, Microsoft said exposure "does not necessarily indicate unauthorized data access or data exfiltration."

Microsoft also says there was no compromise of, or vulnerability in, its own systems. The weak point was trust granted to a third party app.

What ConnectWise did

According to The Register, ConnectWise shut down Cloud Backup, SaaS Security and Cloud Management. CyberScoop reports that the shutdown began on a Saturday, with a phased restoration starting Wednesday and recovery expected to take several days. The Register says CEO Manny Rivelo indicated the affected connections had been contained and services were coming back. ConnectWise did not respond to CSO Online's request for comment.

What admins should do now

Microsoft published detailed guidance, hunting queries and indicators of compromise. The short version for anyone running Microsoft 365 with ConnectWise connected:

1. Keep the ConnectWise connections disabled until ConnectWise gives restoration instructions.
2. Do not delete the enterprise apps first. Preserve them as evidence, and preserve Entra, Purview and SIEM logs before you clean anything up.
3. Search by application ID, not display name. Attackers can rename things. Microsoft lists the app IDs in its post.
4. Review activity from October 15 onward, or from October 1 if your logs go back that far. Look at successful and failed service principal sign ins separately.
5. Audit for persistence: new app credentials, consent grants, role assignments and Conditional Access changes.
6. Then remediate: remove anything unauthorized, rotate credentials and apply least privilege to multitenant apps.

If you are a small business owner and an outside IT provider manages your Microsoft 365 account, ask them directly whether ConnectWise tools were connected and whether they have followed Microsoft's guidance. It is a short conversation and worth having this week.

This lands in an already rough week for defenders. Admins are also rushing to patch the PHP2Shell flaws that let attackers take over web servers, and supply chain style intrusions keep showing up in places like the Ahold Delhaize cyberattack. Our tech section tracks these incidents as they develop.

The bigger lesson: machines are trusted too much

Yash Kadakia of Security Brigade summed up the problem to CSO Online: "We've spent years implementing zero trust for humans while continuing to implicitly trust machines." His advice was simple. "Defenders should focus on what the identity is doing, not whether a human or AI is controlling it."

That is a useful way to read this incident. The attackers did not need a clever zero day. They needed an app that customers had already blessed, plus an AI agent that could try every door quickly. Many companies have dozens of these third party connections with broad permissions, approved once and rarely reviewed. Earlier this year, the case of North Korean IT workers using laptop farms showed a similar pattern on the human side: trusted access that nobody questioned.

What to watch next

Watch for three things. First, whether Microsoft or ConnectWise publishes a count of affected organizations or confirms any data theft. Second, how ConnectWise explains the initial theft of its app credentials, which the reports we read do not fully describe. Third, whether other vendors with privileged Microsoft 365 apps turn up in Storm-0940's activity, since Microsoft says ARTEX is being used by more than one group.

Frequently asked questions

What is the ConnectWise breach?

Attackers took over the identities of several ConnectWise cloud apps that customers had connected to Microsoft 365. Microsoft says the group, Storm-0940, then used them to attempt sign ins to more than 2,250 tenants.

What is ARTEX?

ARTEX is an open source agentic penetration testing framework that works with any AI model. Microsoft says its agents can run an attack from reconnaissance to exfiltration with little human input.

Did the attackers bypass multifactor authentication?

Not in the usual sense. They signed in as a trusted application, not as a user, so user MFA never applied.

Was Microsoft hacked?

Microsoft says no. It says there was no compromise of, or vulnerability in, Microsoft systems, and the access came through ConnectWise app identities.