AI Agents Targeted 2,250 Cloud Tenants in a ConnectWise Breach

The Front Door Was Your IT Vendor's Backup Software

The compromise surfaced publicly on October 15, 2026, when reports of a ConnectWise Cloud Backup breach began circulating with indicators of compromise pointing at the same network range Microsoft had been watching during an earlier password-spraying campaign. ConnectWise published an initial advisory on October 16 describing an investigation into attempted unauthorized access associated with Cloud Backup.^[1]

The mechanism matters more than the vendor name. ConnectWise's application identities had been taken over, which let the attackers "exploit permissions customers had already granted to ConnectWise services, without needing an interactive user login."^[2] The IT management vendor's backup tool is pre-authorized inside a client's Microsoft 365 tenant. An attacker riding that application inherits its permissions and skips the login page entirely. Nobody logs in, so there is no suspicious sign-in to notice.

ConnectWise pulled the plug on Cloud Backup, SaaS Security and Cloud Management after discovering unauthorized access to application identities.^[2] CEO Manny Rivelo warned that "shutting down those connections wouldn't necessarily boot out attackers who had already established a foothold in customer environments."^[2]

AI Agents Did the Reconnaissance and the Break-In

ARTEX is the tooling. Microsoft describes it as an "open-source penetration testing framework that can use any AI model to automate a variety of offensive security workflows."^[1] It is "a system of LLM-driven agents that run an autonomous penetration test from reconnaissance through data exfiltration with little needed human interaction."^[1]

Storm-0940 began using ARTEX as early as September 2026, and in multiple cases the time from initial targeting to privileged access in the target's cloud was less than three hours.^[1] The Register's version: "In some cases, they went from picking a target to gaining privileged cloud access in less than three hours."^[2] The scale came from the agent loop: "Armed with ARTEX, Storm-0940 attempted to authenticate against more than 2,250 Microsoft 365 tenants, at times reaching 2,900 attempts a minute."^[2]

Before that, there was a human-scale attempt. Between October 10 and 14, 2026, Microsoft watched infrastructure at 144.172.64[.]99 run an automated cross-tenant password-spray campaign against 327 accounts across eight organizations, capturing more than 151,000 failed logon events and peaking on October 11 at 2,900 failures per minute.^[1] It failed completely: "Despite the scale, no successful authentication, token issuance, Graph call, or directory change was observed."^[1] That reads like a clean defensive win, but a spray that returns nothing still returns a map. The agent-driven stage did not guess. It used the compromised ConnectWise identities, which were already granted access, so it could skip the spray and attempt sign-in directly inside more than 2,250 tenants.^[1]

That speed breaks defense. As Microsoft puts it, "the speed of the activity allows very little time for Defenders to respond to those alerts and remediate the actor's access in a coordinated fashion."^[1] Only the clock is different. The underlying techniques are nothing new.

What Microsoft Found Inside the Tenants

Most of the targeting did not land. Microsoft says so plainly: "While the majority of the targeting wasn't successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time."^[1] The Register notes that Microsoft has not said how many customers were compromised or whether any data was stolen.^[2]

What did land is worth reading carefully. Microsoft observed AI-accelerated follow-on activity through Microsoft Graph, including reconnaissance, application credential changes and attempts to modify privileges.^[1] An application assigned itself to a high privilege role through an "Add member to a roles" operation, with no prior self-assignment to that role observed for the same application in the preceding seven days, and one of the detections Microsoft ships is specifically for an application self-assigning the Global Administrator role.^[1] The actor also "enumerated cloud resources and read secrets at scale across multiple Azure Key Vaults."^[1]

Then they made it durable, by adding credentials to existing OAuth applications so access kept flowing through Microsoft 365 resources. Microsoft's warning is the sentence administrators should sit with: "These changes can remain active as a backdoor even after the original compromised application is mediated."^[1] One limit: a successful attacker login "does not necessarily indicate that customer data was accessed or exfiltrated."^[1]

Who Was on the List

Storm-0940 is described by Microsoft as a "China-state aligned actor (with no known industry aliases)" that has been active since 2021 and targets organizations across multiple industries for data theft. The sectors Microsoft names include aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits.^[1] Government and military sit on that list alongside aerospace and defense, energy and financial services. When the intruder is a foreign state and the targets include agencies and their suppliers, the goal is not customer records. It is intelligence.

ARTEX is freely available, which is what makes this bigger than one campaign. Microsoft Threat Intelligence has identified threat actors across multiple geographic regions using the framework, and October 2026 public reporting noted ARTEX being used in personal data breaches targeting Korean financial institutions.^[1]

Microsoft's executive vice president Igor Tsyganskiy, writing on LinkedIn, put the scale of what comes next bluntly: "Since early October, a wave of AI-driven cyberattacks has been ongoing", he wrote, calling the ConnectWise supply-chain attack just "one of many".^[3]

What You Should Actually Do

If ConnectWise Cloud Backup, SaaS Security or Cloud Management touched your tenant, the instruction from Microsoft is not the one most people expect: do not delete the application. Microsoft says keep affected connections disabled until ConnectWise provides formal restoration instructions, and warns: "Do not delete enterprise applications as the first response." Configuration and evidence must be preserved before irreversible changes.^[1]

The hunt matters more than the cleanup. Review service principal sign-ins, investigate unexpected application credential or privilege changes, and preserve relevant evidence.^[1] Concretely: review Entra sign-in and audit records, Purview audit records and Graph telemetry; review activity from at least October 15, 2026, extending the service-principal review back to October 1 where records allow; look for service principals that added an application role assignment to themselves; and search by application ID rather than display name.^[1] On confirmed suspicious activity, revoke unnecessary permissions and rotate credentials.^[1]

What to Watch

The number nobody has published. Microsoft has said the activity reached more than 2,250 tenants and that privileged cloud persistence was achieved at many organizations, but not how many customers were compromised or whether data was stolen.^[1][2] Treat the scope as unknown rather than contained.

Whether the backdoor survives the restoration. The credential changes "can remain active as a backdoor even after the original compromised application is mediated."^[1] ConnectWise began restoring services in phases on Wednesday and expects the recovery to take several days.^[3] If a rewritten credential is still live when the service comes back up, the restoration reconnects to the attacker. Whether the self-assigned Global Administrator role gets found is the open question.^[1]

Whether ARTEX shows up next. The framework is freely available and already attributed to actors in several geographic regions.^[1][2] Tsyganskiy called this wave of AI-driven attacks ongoing and the ConnectWise incident one of many.^[3]

Sources

1. Microsoft Security Research and Microsoft Threat Intelligence: "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise" (October 21, 2026) (the primary threat-intelligence writeup: the Storm-0940 attribution as a "China-state aligned actor" active since 2021, the ARTEX framework description, the September 2026 start of the agent-driven attacks, the target sector list, the sub-three-hour path to privileged access, the October 15 public reports of the ConnectWise compromise, the October 16 ConnectWise advisory, the October 10-14 password-spray campaign against 327 accounts across eight organizations with more than 151,000 failed logon events peaking at 2,900 failures per minute on October 11, the attempt to sign in to more than 2,250 tenants, the Microsoft Graph reconnaissance and privilege-modification activity, the application self-assigning a high privilege role including the Global Administrator case, the Azure Key Vault secret reads, the backdoor persistence warning, the mitigation and hunting guidance, and the statement that the activity did not stem from a Microsoft product flaw)
2. The Register: "Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants" (Carly Page, October 22, 2026) (the reporting on the exploitation of permissions customers had already granted to ConnectWise services without an interactive user login, the pull of Cloud Backup, SaaS Security and Cloud Management, the ARTEX-driven authentication attempts against more than 2,250 Microsoft 365 tenants at times reaching 2,900 attempts a minute, the under-three-hour path from target selection to privileged cloud access, the absence of a disclosed count of compromised customers or stolen data, and the ConnectWise CEO Manny Rivelo statement on containment)
3. CyberScoop: "Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group" (Matt Kapko, October 21, 2026) (the reporting on ARTEX being used to "reach more than 2,250 tenants at 2,900 sign-in attempts per minute," the temporary shutdown of ConnectWise services on the Saturday, the phased restoration beginning Wednesday with a multi-day recovery expectation, and the Microsoft executive vice president Igor Tsyganskiy LinkedIn post on an ongoing wave of AI-driven cyberattacks in which the ConnectWise attack is "one of many")