China-linked hackers used AI agents in ConnectWise Cloud Backup breach, Microsoft says

Microsoft says a China state-aligned group it tracks as Storm-0940 was behind the compromise of ConnectWise Cloud Backup, and that it used ARTEX, an open-source agentic AI penetration testing framework, to automate the attack [1]. After the breach, the group tried to sign in to more than 2,250 Microsoft 365 tenants, Microsoft says [1][2].

What happened at ConnectWise Cloud Backup?

ConnectWise says it identified unauthorized access to application credentials associated with Cloud Backup, formerly SkyKick, and first published its advisory on 16 October 2026 [2]. Those multi-tenant apps already had trusted access to customers' Microsoft 365 environments [1].

Microsoft says China-aligned Storm-0940 used the AI framework ARTEX in the ConnectWise Cloud Backup compromise. Using the stolen app identities, the AI agents authenticated to customer tenants without an interactive user sign-in, according to Microsoft [1].

In some environments the agents went further, Microsoft says, into Microsoft Graph reconnaissance, application credential changes for persistence and changes to identities, groups and privileged roles [1]. Microsoft says the activity did not stem from a compromise of or vulnerability in its own systems [1].

How did AI speed up the attack?

Microsoft says the group tried to sign in to more than 2,250 Microsoft 365 tenants at 2,900 attempts per minute. Microsoft describes ARTEX as a multi-agent LLM system that can use any AI model and run a penetration test from reconnaissance to data exfiltration with little human interaction [1].

According to Microsoft, Storm-0940 has used ARTEX since as early as September 2026 against hundreds of organizations, and in multiple cases went from first targeting to privileged cloud access in under three hours [1]. Microsoft says most of the targeting was not successful, but the group still achieved privileged cloud persistence at many organizations [1].

What are ConnectWise and its customers doing now?

ConnectWise says it reset all accounts and credentials in the affected environment on 19 October and is restoring services in controlled phases, a process it expects to take several days [2]. It says existing backup archives remain encrypted, isolated and preserved, with no indication of compromise [2].

ConnectWise says its containment does not remove access attackers may already have in customer tenants. Microsoft advises customers to keep affected connections disabled, preserve evidence and review service-principal sign-ins from at least 15 October [1][2].

TechCrunch reported that thousands of companies were spied on after the breach [3]. Microsoft itself cautions that an affected app or a successful sign-in does not necessarily mean data was accessed or exfiltrated [1].

Our read

Opinion: The tool is not new magic; password spraying and OAuth abuse are old tricks. What changes is the pace: one stolen vendor credential plus an agent framework turned into thousands of tenant sign-in attempts before most defenders had read the first advisory. Third-party app permissions now deserve the same scrutiny as admin accounts.

What we could not verify

• Whether customer data was actually accessed or exfiltrated; Microsoft says successful authentication does not necessarily mean data was taken.
• How many of the targeted tenants were successfully compromised; Microsoft says most targeting was not successful but gives no count.
• TechCrunch's framing that thousands of companies were spied on; Microsoft's primary figure is attempted sign-ins to more than 2,250 tenants.
• How the attackers first obtained the ConnectWise application credentials; ConnectWise says its investigation is ongoing.
• Which AI models Storm-0940 ran inside ARTEX; Microsoft does not say.