Microsoft ties ConnectWise supply-chain attack to China-aligned hackers using ARTEX AI agents

What Microsoft found

Microsoft said on 21 October 2026 that a China-state aligned hacking group used an openly available AI agent framework to attack hundreds of organisations around the world, and that the same group was behind the recent supply-chain compromise of ConnectWise's Cloud Backup service. In a Microsoft Security Blog report, Microsoft Threat Intelligence names the group Storm-0940 and the tool ARTEX, an open-source penetration testing framework that uses AI models to automate offensive security work.

According to Microsoft, Storm-0940 has used ARTEX since at least September 2026 against targets in aerospace and defence, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, the military, semiconductors, software, technology, and think tanks and non-profits. Several of those attacks ended with the group holding privileged access to a victim's cloud infrastructure, and Microsoft says that in multiple cases the time from first targeting to privileged access was less than three hours.

Microsoft says most of the targeting did not succeed, but that the group still "achieved privileged cloud persistence at many organizations in a brief time." It also stresses that the activity "did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services." The access came through a third party's application that customers had already trusted.

How the ConnectWise breach unfolded

ConnectWise sells software to managed service providers, the IT firms that run systems for many smaller businesses. Its Cloud Backup product, formerly called SkyKick, backs up customers' Microsoft 365 data, which means it needs broad, standing permission inside each customer tenant. ConnectWise's Trust Center advisory says it "identified unauthorized access to application identities" associated with Cloud Backup, and at 05:01 UTC on 17 October it announced it was shutting off the product's application access, interrupting backups for all customers.

Over the next day ConnectWise said it had revoked the certificates used by the affected connections and had disabled seven application identities at 07:00 UTC on 17 October. It also took its SaaS Security and Cloud Management products offline as a precaution because they are integrated with Cloud Backup. The company says its backup archives remained encrypted, isolated and preserved, with no indication that they were compromised, and that since mitigations began it has not seen successful threat activity in the environments it monitors.

The catch, which ConnectWise repeats in almost every update, is that it cannot see inside its customers' Microsoft 365 tenants. Disabling the stolen app identities stops new sign-ins through them, but it does not undo anything an intruder already changed. At 22:00 UTC on 21 October, ConnectWise said that based on its evidence, "including threat intelligence shared by Microsoft, it appears that a China state-aligned group was responsible", and that the group "used an openly available agentic AI framework to automate and speed up its operation." Restoration is under way in stages and is expected to take several days.

ARTEX turned old tricks into machine-speed attacks

Microsoft describes ARTEX as a multi-agent system written in Go with a Next.js web interface. It can use any AI model, and its agents run a penetration test "from reconnaissance through data exfiltration with little needed human interaction", storing the assets and weaknesses they discover in a graph as they go. The interface defaults to English but can be switched to Korean, Mandarin, Spanish or Japanese.

Storm-0940 itself is not new. Microsoft says it has been active since 2021, usually breaking in with password spraying or by exploiting internet-facing applications, and in cloud environments it has long kept access by adding its own credentials to existing OAuth applications, then reading email and other data through Microsoft Graph. What changed is the pace. In the ConnectWise case, Microsoft says the group used ARTEX to speed up scanning, password spraying and abuse of OAuth applications at downstream victims, and to attempt sign-ins to more than 2,250 tenants at 2,900 attempts per minute.

Microsoft's argument is that this kind of volume is noisy but still hard to stop. Automated attacks "generate a large volume of traffic and log data that may generate alerts. However, the speed of the activity allows very little time for Defenders to respond to those alerts and remediate the actor's access in a coordinated fashion." Agents, it notes, can work around the clock and try several breach paths at the same time.

A password spray that pointed to the same attacker

Microsoft links Storm-0940 to the ConnectWise breach partly through infrastructure. Between 10 and 14 October, it says, the group ran an automated password-spray campaign from the address 144.172.64[.]99 against 327 accounts at eight organisations, trying to get into Microsoft 365 and Exchange Online. Microsoft counted more than 151,000 failed logons, with a peak of 2,900 failures per minute on 11 October and more than 111,000 failures in a single day. Forty-eight accounts each received more than 1,000 failed attempts, and nearly 98% of responses were account lockouts.

That campaign failed: Microsoft says it saw no successful sign-in, token, Graph call or directory change. But on 15 October, the day after it ended, public reports of the ConnectWise compromise began to circulate with indicators from the same 144.172.64.x range, and a later ConnectWise advisory listed an address matching 144.172.64[.]99 exactly. ConnectWise's own first notice named 144.172.64.128 as a suspicious source of sign-ins by its Cloud Backup application.

What the agents did inside customer tenants

Once the attackers controlled the identities of several ConnectWise cloud applications, Microsoft says, "the AI agents operating on behalf of the threat actor" used them to authenticate to customer environments, "effectively taking advantage of the already established trust by these apps within a tenant." Because the apps signed in as themselves, no person had to log in, which is why the usual user-focused controls did not apply.

In some tenants the agents went further, into Microsoft Graph and directory operations: reconnaissance, changing application credentials to keep access, and changes to identities, groups and privileged roles. Among the detections Microsoft lists is an alert for an application that "self-assigned Global Administrator role", and its technique list mentions self-assignment of global admin by one of the ConnectWise management applications. Microsoft warns that credentials added this way "can remain active as a backdoor even after the original compromised application is" fixed.

Microsoft has not said how many customers were actually compromised, and it is careful to add that a successful sign-in "does not necessarily indicate that customer data was accessed or exfiltrated." CyberScoop reports that Microsoft executive vice president Igor Tsyganskiy described the ConnectWise attack as "one of many" in what he called a wave of AI-driven cyberattacks that has been under way since early October.

What administrators are told to do

Both companies tell administrators the same thing first: keep the affected ConnectWise connections disabled until ConnectWise gives formal restoration instructions, and do not delete the enterprise applications as a first step, because their configuration is evidence. ConnectWise's investigation and remediation guide asks managed service providers to review their own tenant and every customer tenant they manage, including tenants with dormant SkyKick connections, and to match applications by ID rather than by display name.

Microsoft lists four application IDs to check, covering ConnectWise Cloud Backup, two ConnectWise Microsoft Teams and Graph applications, and the SkyKick Partner Portal. It recommends reviewing activity from at least 15 October, and back to 1 October where logs exist; reviewing successful and failed service-principal sign-ins separately; and searching Entra audit logs for new application credentials, owners, app-role assignments, consent grants, privileged role changes and Conditional Access edits. Mail access, forwarding rules and transport rules should be checked too.

ConnectWise adds a practical warning about log retention. Entra normally keeps sign-in and audit records for seven days on the free tier and 30 days on P1 and P2 licences, and "a license upgrade does not recover expired history." For a breach that began in mid-October, some small tenants may already be losing the evidence they need. Microsoft has also published Defender detections and advanced hunting queries for the activity.

Why this changes the ARTEX story

Until now the public record on ARTEX was about financially motivated crime. On 7 October CrowdStrike tied ARTEX to attacks on South Korean finance by an unnamed, Chinese-speaking actor, and on 19 October GMO Cybersecurity by Ierae found ARTEX on servers attacking Japanese firms sector by sector. Neither firm attributed those campaigns to a government.

Microsoft's report is the first by a major vendor to say a state-aligned group is using the tool, and to connect it to a supply-chain compromise with downstream victims. It also says threat actors "across multiple geographic regions" now use ARTEX, which fits a pattern AI Lookout has tracked this month, from one hacker's exposed Cairn panels to Railway's breach aimed at AI API keys: attackers are using AI agents to do familiar work, such as spraying passwords and abusing trusted integrations, far faster than before.

What is still unknown

Important pieces are still missing. ConnectWise has not said how its application credentials were first obtained; its updates say independent specialists are still working that out. Neither company has published a count of tenants where the attackers made changes or read data, and Microsoft has not named the AI models Storm-0940 used with ARTEX. Microsoft's attribution is to a "China-state aligned" group with no known aliases at other security firms, not to a named agency.

For administrators, the open questions matter less than the checklist. Any tenant that ever authorised Cloud Backup or SkyKick should be reviewed now, while logs still exist, for app credentials, role assignments and consent grants that nobody can explain. ConnectWise says it will publish updates twice a day from 22 October.