Innhold Show
The ConnectWise breach gave a China-linked hacking group a trusted route toward more than 2,250 Microsoft 365 environments. The attackers then used AI agents to test stolen application identities across customer tenants at machine speed. In several affected environments, the activity progressed to discovery and attempts to establish persistent, privileged access.
This was not a chatbot suddenly teaching itself how to hack. The attackers had gained control of identities belonging to ConnectWise applications that customers already trusted. The ARTEX AI tool allowed them to abuse that trust faster, more broadly, and more systematically than a person could have done by hand.
The facts are serious enough without exaggeration. Microsoft documented attempts to reach more than 2,250 environments, but also stressed that an affected application or a successful sign-in does not by itself prove that data was read or extracted. As of October 23, ConnectWise said it had found no evidence that the backup archives themselves were compromised. Every customer environment still needs to be investigated separately.
What happened in the ConnectWise breach?
The attackers gained unauthorized access to application identities connected to ConnectWise Cloud Backup, formerly known as SkyKick. These identities linked ConnectWise services to customers’ Microsoft 365 environments. Once an identity has already been granted permission, it can authenticate as a trusted application without a normal user signing in interactively.
Microsoft attributes the attack to Storm-0940, a China-linked threat actor that has been active since 2021 and focuses on data theft. The group has previously used password spraying, vulnerable internet-facing services, and OAuth applications to gain and retain access to cloud environments.
ConnectWise discovered the problem on October 14 and published its first notice on October 16. The company suspended Cloud Backup, SaaS Security, and Cloud Management, reset accounts and credentials in the affected environment, and began a controlled recovery. As of October 23, testing and security validation were expected to finish over the weekend before features could gradually be restored.
This is a supply-chain attack in practical terms. An attacker does not need to break through the outer wall of 2,250 businesses one by one when a supplier connection already has access. If that connection can operate across many customers, one stolen application identity becomes a master key with far too many doors in front of it.
How did the attackers use AI agents?
Storm-0940 used ARTEX to automate discovery, password spraying, and the abuse of OAuth applications. ARTEX is an open-source penetration-testing framework in which multiple LLM-powered agents can work from initial reconnaissance through data extraction with little human involvement. It can use different AI models and builds a graph of systems, access paths, and weaknesses as it works.
After gaining control of the ConnectWise identities, the attackers used the agents to attempt access across more than 2,250 customer environments. Microsoft recorded more than 200 sign-ins in under four minutes. The separate password-spraying operation that preceded the ConnectWise activity peaked at more than 2,900 failed attempts per minute. Both show the same defensive problem: an alert may be accurate, but the incident may already have moved several steps further before anyone opens the ticket.
In some environments, the activity continued through Microsoft Graph. The attackers mapped the directory, changed application credentials, and tried to manipulate identities, groups, and privileged roles. Those changes can create a new back door that survives even after the original ConnectWise connection has been shut down.
Microsoft also describes separate ARTEX-driven attacks in which Storm-0940 obtained privileged cloud access in less than three hours. Since September, the group has used the framework against hundreds of organizations in sectors including defense, energy, finance, government, manufacturing, software, and technology. This was not an isolated demonstration. AI agents had been added to an established offensive workflow and put to operational use.
How many organizations were actually compromised?
Attackers attempted to reach more than 2,250 Microsoft 365 environments, but that does not mean 2,250 organizations were fully compromised. Microsoft found successful sign-ins and follow-on activity in several customer environments, but it has not published a total number of confirmed data breaches. Most targets in the wider Storm-0940 campaign were not compromised.
The same distinction matters for the large password-spraying operation between October 10 and 14. Microsoft recorded more than 151,000 failed sign-ins against 327 accounts at eight organizations. Nearly 98 percent of the responses were account lockouts, and Microsoft observed no successful authentication, token issuance, Graph calls, or directory changes from that particular part of the campaign.
TechCrunch described the incident as spying on thousands of companies. That is a sharp headline, but the primary evidence is more careful. A successful application sign-in can provide access to email and files, and Storm-0940 has a history of extracting that kind of data. Even so, Microsoft explicitly says that neither the presence of the application nor authentication alone proves that customer data was accessed or stolen.
ConnectWise says the existing backup archives are encrypted, isolated, and preserved with no evidence of compromise. The company has also found no evidence that other ConnectWise products were affected. That does not clear the individual Microsoft 365 environments, because any access or extraction there must be investigated in their own logs.
Why does supplier trust matter more than the model name?
The AI agent did not create the trust that was abused. It made the abuse fast enough to leave defenders with very little reaction time. The decisive security failure was that compromised application identities already had permissions across many customer environments.
It is easy to fixate on ARTEX because “an AI agent hacked thousands” makes a better headline than “overly broad OAuth permissions had serious consequences.” But the second version is the lesson businesses can actually use. The agent could be replaced by another framework or a collection of scripts. A trusted multi-tenant application with broad permissions would still be an extremely attractive entry point.
I think this incident should remove any remaining doubt that agentic AI already has practical significance in cyberattacks. Not because the model invented a new form of hacking, but because it could run familiar techniques continuously, try several routes at once, and follow up a finding at machine speed. The gap between “we received an alert” and “we stopped the attack” shrinks with every automated action.
The same trust problem appears whenever AI agents receive API keys and access to cloud services. A key or application identity is not merely a technical detail. It represents every action its owner is allowed to perform. If that identity spans many customers, the blast radius grows before the first AI agent sends a single request.
What should ConnectWise customers do now?
Affected ConnectWise connections should remain disabled until ConnectWise formally confirms that the relevant service can be restored. Do not delete the enterprise applications as a first step. Microsoft recommends preserving configuration and logs before making irreversible changes, so the incident response does not destroy the evidence it needs.
Review every Microsoft 365 environment where the affected ConnectWise applications are or were installed. Search by application ID, not just by display name. Preserve Entra logs, Purview Audit data, SIEM records, and available Microsoft Graph telemetry. Investigate both successful and failed service principal sign-ins from at least October 15. Where the logs are available, Microsoft recommends going back to October 1.
Look specifically for new application credentials, owners, and service principals; application-role assignments; new consent grants; privileged roles; and changes to users, groups, authentication methods, or Conditional Access. Check for unusual access to email and files, downloads, forwarding, inbox rules, and mail-flow rules as well.
ConnectWise’s continuing security advisory makes an important point: the supplier’s cleanup does not remove access an attacker may already have established inside a customer’s environment. Waiting for Cloud Backup to return is not enough. Every organization and every managed service provider must examine both its own environments and the ones it manages.
If you find suspicious activity, secure the evidence first and have an authorized incident-response team remove unknown keys, roles, consent grants, and identities. Rotate affected credentials and verify that the cleanup actually removed persistent access. This is not the day to make the portal look tidy and hope that the absence of red alerts means everything is fine.
What should other businesses learn from the attack?
Start with an inventory of multi-tenant applications, OAuth consent grants, and service principals that can access your cloud environment. Ask which of them can read email, files, and directory data, and which can change roles or application credentials. An integration that is no longer used should not keep standing access merely because nobody has cleaned it up.
Apply least privilege and use the shortest practical lifetime for keys. Monitor application sign-ins as identities in their own right, not as background noise beneath ordinary user logs. Alert on new credentials, self-assigned roles, unexpected Graph calls, and activity from supplier applications outside known infrastructure.
Defenders also need to plan for machine speed. A person reviewing 2,900 attempts per minute one alert at a time has lost before the coffee is ready. Automated isolation may be necessary when indicators are clear, but it must be rehearsed and precisely constrained so that an attack is not replaced by a self-inflicted outage.
The sober conclusion is uncomfortable: this attack required both a valuable supplier foothold and AI-driven speed. Pretending AI made no difference is just as wrong as blaming everything on AI. Secure the trust first, restrict what each application can do, and build a response that can actually react while the attacker is operating at machine speed.
Frequently asked questions
Were all 2,250 ConnectWise customers hacked?
No. Microsoft says the attackers attempted to sign in to more than 2,250 Microsoft 365 environments. Successful sign-ins and follow-on activity occurred in several environments, but 2,250 is not a confirmed count of completed breaches or data theft.
Was ConnectWise backup data stolen?
As of October 23, 2026, ConnectWise said its backup archives were encrypted, isolated, and preserved with no evidence of compromise. That does not rule out unauthorized activity inside individual customers’ Microsoft 365 environments, which must be investigated separately.
What is ARTEX?
ARTEX is an open-source framework for agentic penetration testing. Multiple AI agents can automate discovery, vulnerability research, tool use, and follow-up activity. Storm-0940 used the framework to accelerate password spraying and the abuse of OAuth applications.
What is the most important step for affected organizations?
Keep affected ConnectWise connections disabled, preserve logs and configuration, and investigate service principal sign-ins, Graph activity, new application credentials, and role changes. Do not simply wait for ConnectWise to restore the service.
