ConnectWise Cloud Backup Breach Storm-0940 ARTEX AI What to Check: AI Agents Tried 2,250 Microsoft 365 Tenants at 2,900 Attempts a Minute

Image: Microsoft — Storm-0940 ARTEX campaign (official research image)

TL;DR — The connectwise cloud backup breach storm-0940 artex ai what to check story in one line: Microsoft says a China state-aligned group used AI agents and stolen ConnectWise app credentials to try signing in to more than 2,250 Microsoft 365 tenants at up to 2,900 attempts a minute — keep ConnectWise connections off and hunt your Entra logs for planted back-door credentials now.

📌 KEY HIGHLIGHTS

• What: Microsoft Threat Intelligence (21 October 2026) attributes the ConnectWise Cloud Backup supply-chain compromise to Storm-0940, a China state-aligned actor active since 2021, using ARTEX, an agentic AI penetration-testing framework.
• Scale and speed: after a password-spray wave of 151,000+ failed logons (10–14 October, zero successes), the agents switched on 15 October to stolen ConnectWise application identities and attempted sign-ins against more than 2,250 tenants at up to 2,900 attempts per minute.
• Why it is dangerous: the apps were already trusted, so no user sign-in or MFA prompt was involved. In some environments the agents then changed app credentials and privileges — a back door that can survive even after the original ConnectWise app is fixed. Some cases went from first targeting to privileged access in under 3 hours.
• Honest limits: Microsoft says the majority of targeting was not successful, has not said how many tenants were actually compromised, and stresses that a successful attacker sign-in does not necessarily mean data was accessed or stolen.
• Status: ConnectWise completed a full credential reset on 19 October; phased restoration began 21–22 October and is expected to take several days. Affected connections must stay disabled until ConnectWise issues formal reconnection instructions for your service.

What happened?

ConnectWise sells tools that IT providers (MSPs) use to manage and back up their clients' Microsoft 365 data. Its Cloud Backup product — formerly SkyKick — connects to customer tenants through application identities that customers have already approved. On 16 October 2026, ConnectWise published its first advisory about unauthorized access to those application credentials, and it later shut down Cloud Backup, SaaS Security and Cloud Management while it investigated.

On 21 October, Microsoft named the attacker. In its primary research post, Microsoft says Storm-0940 had been using ARTEX since as early as September 2026 to automate attacks on hundreds of organisations worldwide — across aerospace and defence, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology and non-profits. ARTEX began life as a legitimate open-source penetration-testing framework: a multi-agent system, written in Go, that can use almost any AI model to run a test from reconnaissance through to data theft with little human interaction. The ConnectWise incident is what happens when that automation is pointed at a supplier that sits inside thousands of companies at once.

How the attack unfolded: spray first, trusted apps second

Date (2026)	What Microsoft / ConnectWise report
10–14 Oct	Automated password spray from one Storm-0940 server (144.172.64[.]99) against 327 accounts at 8 organisations: 151,000+ failed logons, peaking at 2,900 failures a minute on 11 Oct. No successful sign-in.
15 Oct	The agents gain the identities of several ConnectWise cloud applications and start authenticating to customer tenants as those already-trusted apps — no interactive user sign-in needed.
16 Oct	ConnectWise publishes its initial Cloud Backup advisory; services are shut down in the following days.
19 Oct	ConnectWise completes a full reset of accounts and credentials in the affected Cloud Backup environment.
21–22 Oct	Microsoft publicly attributes the campaign to Storm-0940; ConnectWise begins phased restoration (22 Oct, 00:45 UTC update) and promises twice-daily updates.

The second phase is the part to understand. Once inside a tenant as a trusted app, Microsoft observed the agents working through Microsoft Graph: mapping the directory, adding new credentials to applications, and changing identities, groups and privileged roles. That is persistence, not just access — remove the original app and the planted credentials can remain. It is the same trust problem we explained in our CERT-In eMudhra certificate compromise advisory explainer: when the trusted thing itself is abused, every customer of that thing has to check their own house.

Illustrative image: Wikimedia Commons / U.S. National Guard, public domain — cyber security incident-response exercise

ConnectWise cloud backup breach Storm-0940 ARTEX AI what to check in your tenant

Microsoft's guidance is unusually specific, and it applies to every tenant where the affected apps are installed now or were installed in the past — an app you stopped using can still hold permissions today. Work through it in this order:

• Keep connections disabled. Do not reconnect any affected ConnectWise service until ConnectWise publishes formal instructions for that service.
• Do not delete the apps first. Preserve the enterprise applications' configuration plus your Entra sign-in and audit logs, Purview records and SIEM data before making irreversible changes — and do not delay containment while exports run.
• Search by application ID, not name. Microsoft lists four IDs to inventory in every tenant, starting with ConnectWise Cloud Backup: 506e08f9-6e9a-4da4-942b-a099a03644ae. Record the local service-principal Object ID for each.
• Review from 15 October — ideally 1 October. Check successful and failed service-principal sign-ins, and do not limit the review to the published IP addresses.
• Hunt for back doors. In Entra audit logs, look for added app or service-principal credentials, new apps or owners, consent grants, app-role and privileged-role assignments, and changes to users, groups, authentication methods or Conditional Access. In Microsoft 365 audit records, check for unusual mail or file access, downloads, forwarding and inbox or transport rules, and delegated mailbox permissions.
• Clean only after preserving evidence. Have an authorised responder remove confirmed unauthorised credentials, grants and role assignments, rotate credentials, and verify the vendor's rotation actually closed the access.

If your team is also catching up on this month's other urgent fixes, our Plex Media Server Plex2Shell vulnerability update guide covers the patch CISA wants applied by 23 October, and the Python 3.15.1 security update how-to-upgrade guide covers the certificate-trust fix that followed the eMudhra incident.

Should you care?

✅ Care now if your organisation — or your MSP — uses or ever used ConnectWise Cloud Backup, SaaS Security or Cloud Management with Microsoft 365. The check above is a few hours of log review against a risk of silent, persistent admin-level access. ⏳ Everyone else: treat this as the clearest public example yet of machine-speed supply-chain attack. The techniques are old — password spraying, stolen credentials, OAuth app abuse — but AI agents ran them around the clock and, in some cases, reached privileged access in under three hours. Defences built on a human spotting one odd sign-in will not keep up; automated thresholds for disabling credentials and revoking tokens are the direction Microsoft, ConnectWise and independent analysts are all pointing to.

FAQs

What happened in the ConnectWise Cloud Backup breach?
Attackers obtained application credentials belonging to ConnectWise Cloud Backup (formerly SkyKick). Because customer Microsoft 365 tenants already trusted those apps, the attackers could authenticate as the apps themselves — no user password or MFA prompt — and in some tenants went on to plant new credentials and change privileged roles. ConnectWise shut the services down, reset all credentials on 19 October, and is restoring them in phases.

What is ARTEX and how did Storm-0940 use it?
ARTEX is an open-source, multi-agent AI penetration-testing framework (written in Go) that automates offensive-security work from scanning to data theft with little human input. Microsoft says Storm-0940 used it to accelerate reconnaissance, password spraying and OAuth application abuse — reaching 2,900 sign-in attempts per minute against more than 2,250 tenants, a pace that leaves human defenders very little time to react.

What should Microsoft 365 admins check right now?
Keep ConnectWise connections disabled, preserve logs and app configuration before deleting anything, inventory the four application IDs Microsoft lists (starting with Cloud Backup, 506e08f9-6e9a-4da4-942b-a099a03644ae), and review service-principal sign-ins plus Entra and Microsoft 365 audit records from at least 15 October — looking specifically for added credentials, consent grants, role changes and mailbox forwarding rules.

Does a successful attacker sign-in mean my data was stolen?
No — not by itself. Microsoft states plainly that the presence of an affected application, or even a successful threat-actor authentication, does not necessarily indicate that customer data was accessed or exfiltrated. It is a trigger to investigate, not proof of a data breach, and Microsoft has not disclosed how many tenants were ultimately compromised.

TAKEAWAY: One trusted backup app became a key to 2,250+ Microsoft 365 tenants because AI agents could abuse its credentials at machine speed. Keep the connection off, hunt for planted credentials by application ID, and review your third-party app permissions before an incident does it for you.

Follow USA Tech on TechByCountry for tomorrow's hourly update.

SOURCES: Microsoft Security Blog — Storm-0940 uses ARTEX (primary, 21 Oct 2026) · ConnectWise Trust Center — Cloud Backup advisories (updated 22 Oct 2026) · The Hacker News (22 Oct 2026) · The Register (22 Oct 2026) · CSO Online (22 Oct 2026)