Agentic AI Attack on ConnectWise Backup Reached 2,250 Microsoft 365 Tenants

The breach of a ConnectWise cloud backup application gave China-aligned group Storm-0940 a way to automate attacks across Microsoft 365 tenants. Microsoft says the group used stolen credentials and the open-source ARTEX agentic AI framework to attempt access to more than 2,250 tenants, with some operations reaching privileged cloud access in under three hours.

The scale and pace are the signal for security teams. ARTEX sent as many as 2,900 sign-in attempts per minute, using identities belonging to ConnectWise cloud applications that already had permission to access customer environments. Because those applications could authenticate without an interactive user sign-in, defenses centered on employee logins weren’t enough to stop the activity.

App permissions became the attack path

Microsoft attributed the activity to Storm-0940 and said the group had used ARTEX since at least September 2026 to automate attacks against hundreds of organizations. Microsoft also said its own systems, products, and services weren’t compromised or exploited.

After gaining access to some environments, the attackers used Microsoft Graph and directory operations to conduct reconnaissance and alter application credentials, identities, groups, and privileged roles. Those changes can preserve access after defenders address the original application, Microsoft warned.

ConnectWise issued an initial advisory on October 16 about attempted unauthorized access involving its Cloud Backup product, then expanded its containment guidance. The company didn’t immediately respond to a request for comment.

Yih Khai Wong, IDC Asia/Pacific’s senior research manager for security services, said the response window can outpace human review. “2,900 sign-in attempts per minute and gaining privileged cloud access in under three hours is not a timeline any human analyst queue can keep up with, no matter how well-staffed the SOC,” he said.

Wong argues that predefined thresholds should trigger containment steps automatically, including disabling credentials, revoking tokens, and isolating service principals. Analysts can review those actions afterward; waiting for a person to approve each one leaves too little time, he said.

Third-party apps need privileged-account controls

For Yash Kadakia, founder and CTO of Security Brigade, the incident highlights an imbalance in enterprise access controls. Organizations often protect employee sign-ins with multifactor authentication and conditional access while leaving third-party applications with broad permissions and noninteractive authentication.

“We’ve spent years implementing zero trust for humans while continuing to implicitly trust machines,” Kadakia said. He recommends treating vendor integrations like privileged accounts: limit their permissions, monitor activity continuously, review access regularly, and maintain a tested revocation process. Even an app that’s no longer in use may retain access, he cautioned.

Wong described responsibility as shared. ConnectWise must protect the credentials and infrastructure that allow its applications to reach customer tenants, while customers need to track what access they granted, to which applications, and for how long.

Open-source agents lower the barrier

ARTEX is a Chinese open-source multi-agent large language model system that can work with any AI model. Its agents can carry out a penetration test from reconnaissance through data exfiltration with little human input. Microsoft said October reporting connected the framework to breaches at Korean financial institutions and noted that actors in multiple regions are using it.

Storm-0940 has been active since 2021, according to Microsoft. The group’s ARTEX-driven targeting has included aerospace and defense, energy, financial services, government, semiconductor, and technology organizations. Most attempts failed, Microsoft said, though the group established privileged cloud persistence at many organizations in a short period.

Wong sees the tooling as part of a broader shift: open-source frameworks and access to an LLM API can put capabilities once associated with well-resourced groups within reach of more attackers. Kadakia adds that individual requests may not reveal whether a human or an AI agent is operating an identity. A valid API call made with stolen credentials can look legitimate either way. “Defenders should focus on what the identity is doing, not whether a human or AI is controlling it,” he said.

Microsoft’s guidance for affected tenants

Microsoft advised customers to keep affected ConnectWise connections disabled until ConnectWise provides restoration instructions. It recommends searching tenants using the four affected application IDs, rather than display names, and preserving Entra, Purview, and SIEM records. Organizations should review activity from at least October 15, and extend the search to October 1 where records are available.

Microsoft also cautioned that finding an affected application—or seeing a successful authentication—doesn’t by itself establish that data was accessed or exfiltrated. The practical takeaway for security teams is to inventory application permissions and build response controls around identity behavior, where automated attacks can turn a narrow access path into a tenant-wide problem in hours.