Microsoft attributes the ConnectWise Cloud Backup…

Microsoft attributes the ConnectWise Cloud Backup compromise to the China-state-aligned actor Storm-0940 and reports that it used ARTEX to automate attacks and abuse stolen application identities across customer Microsoft 365 tenants. Microsoft says most targeting failed and that application exposure or a successful sign-in alone does not establish data access. ConnectWise’s October 28–29 updates describe phased restoration through a new application, requiring tenant reauthorization and verification that backups actually resume; they do not establish complete service restoration.

Why it matters

It is a large vendor's account of an agent framework used to speed a supply-chain intrusion through trusted application identities, with Microsoft reporting under three hours from targeting to privileged access in multiple instances across the campaign.

Key facts

As stated in the sources, with where to find them.

Microsoft describes Storm-0940 as a China-state aligned actor with no known industry aliases, active since 2021 and focused on data theft, which has historically used password spraying, exploitation of internet-facing applications, and credentials added to existing OAuth applications. Microsoft states its responsibility for the ConnectWise compromise as an assessment.Microsoft post, opening; What's happening
Microsoft says that from as early as September 2026 Storm-0940 used ARTEX against hundreds of organizations in sectors including aerospace and defense, energy, financial services, government, semiconductors, software and think tanks. It says the majority of the targeting was not successful, but several attacks reached privileged cloud access, in multiple instances less than 3 hours after initial targeting.Microsoft post, What's happening
Microsoft describes ARTEX as an open-source penetration-testing framework that can use any AI model: a multi-agent system written in Go with a Next.js front end, with interface languages including Korean and Mandarin, that runs a test from reconnaissance to data exfiltration with little human interaction. It says it has seen threat actors in multiple geographic regions using ARTEX.Microsoft post, What is ARTEX?
Between 2026-10-10 and 2026-10-14, per Microsoft, a cross-tenant password-spray campaign from Storm-0940 infrastructure targeted 327 accounts at eight organizations, producing more than 151,000 failed logon events, a peak of 2,900 failures per minute on 2026-10-11, and more than 111,000 failures in one day; 48 accounts received more than 1,000 failures and lockouts were nearly 98% of responses. Microsoft observed no successful authentication in that campaign.Microsoft post, Password Spraying
Microsoft links the spray to the ConnectWise compromise through overlapping infrastructure: an address among indicators ConnectWise later added to its advisory, first posted 2026-10-16, matched the spray infrastructure. It says that after the unauthorized access, Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 tenants at 2,900 sign-in attempts per minute. Microsoft gives the same per-minute figure for the earlier spray peak; BusinessToday attaches the spray's 151,000 failed logons to the downstream ConnectWise-app sign-ins.Microsoft post, What is ARTEX?; Downstream customer access; BusinessToday article
Microsoft reports that after taking control of the identities of multiple ConnectWise cloud applications, agents acting for the actor authenticated to customer tenants through the trust those applications already held, without an interactive user sign-in. In some tenants this progressed to Microsoft Graph reconnaissance, application credential changes for persistence, and changes to identities, groups and privileged roles; its detection list includes an application assigning itself the Global Administrator role.Microsoft post, opening; Downstream customer access; Microsoft Defender XDR detections
Microsoft says the presence of an affected application, or even successful authentication, does not necessarily indicate data access or exfiltration, and that the activity did not result from a compromise of or vulnerability in Microsoft corporate systems, products or services. The post does not give a count of tenants with follow-on activity or confirmed data loss.Microsoft post, opening; Downstream customer access
The post does not explain how Microsoft determined that the activity was driven by ARTEX or by AI agents rather than conventional automation; it states the attribution and describes the speed and volume of the activity.Whole post
Microsoft advises keeping affected ConnectWise application connections disabled until ConnectWise gives restoration instructions, preserving configuration and logs before deleting enterprise applications, reviewing service-principal sign-ins from at least 2026-10-15 (extending to 2026-10-01 where records exist), and reviewing credential, role and consent changes.Microsoft post, Mitigation and protection guidance, Immediate actions
ConnectWise’s October 21 update says it appeared that a China-state-aligned group was responsible and that the group used an openly available agentic AI framework, drawing in part on Microsoft’s intelligence. This is an affected company’s account, not independent confirmation of Microsoft’s attribution method.ConnectWise advisory, 2026-10-21 22:00 UTC update
In its rolling advisory updated on 2026-10-24 at 14:00 UTC, ConnectWise reported controlled restoration and certificate rotation, targeting phased partner onboarding from October 26 subject to security checks. It said bringing infrastructure online did not mean all capabilities were available, kept affected connections disabled pending instructions, and reported no indication of compromise to its encrypted, isolated backup archives.ConnectWise advisory, 2026-10-24 14:00 UTC update
ConnectWise’s October 28 16:00 UTC update begins phased restoration with Microsoft 365 backups and restores through a new application; the October 29 20:45 UTC update says restoration continues. Partners must reset passwords, configure multifactor authentication and reauthorize tenants. Reauthorization alone does not establish resumed backups, and previously disabled applications remain disabled unless ConnectWise instructs otherwise.ConnectWise advisory, October 28 and October 29 restoration updates

Record updates

Oct 24, 2026 · New evidence
Added ConnectWise’s incident advisory and its 2026-10-24 restoration update. Restoration and the onboarding target remain conditional; ConnectWise’s tentative attribution partly relies on Microsoft’s intelligence.
Oct 30, 2026 · New evidence
Added ConnectWise’s October 28–29 phased-restoration updates. The earlier October 26 onboarding target is preserved as a historical target, while resumed backups require tenant reauthorization and successful-snapshot verification.

Findings that cite this record

Aug 27, 2025

Attackers have used AI agents to carry out much of the work of real intrusions, from reconnaissance to credential theft and extortion, with people directing them at a few decision points.

Corroboratedobserved13 evidence records1 linked finding

Oct 22, 2026

Attackers have run real intrusions with publicly available, open-source agent frameworks such as ARTEX, PentAGI and Hermes Agent, not only with commercial AI products.

Corroboratedobserved7 evidence records

Key questions this bears on

Where are deployed AI agents actually being exploited?Mostly around the model: connectors, credentials, tools, and packages, rather than the model alone.
Do cyber evaluations of AI agents stay contained?Not reliably. Evaluation, training and research agents have reached real systems outside scope, as labs and national authorities report.
How are attackers using AI agents in real operations?To run parts of intrusions at scale: vendors report a state-aligned actor and criminal groups using open-source agent frameworks and commercial models.