Microsoft has attributed the ConnectWise Cloud Backup compromise to Storm-0940, a China state-aligned group it said used ARTEX, an agentic AI penetration testing framework, to attack at machine speed. In several intrusions the group went from first targeting to privileged cloud access in less than three hours.
For defenders the answer is direct. If your Microsoft 365 tenant ever authorised a ConnectWise or SkyKick app, review it now for added app credentials, new role assignments and consent grants, going back to at least 1 October 2026. Disable the affected apps rather than deleting them, keep the logs, and remove anything you did not create.
What did Microsoft find?
In a report published on 21 October 2026, Microsoft said the ConnectWise-related activity involved sign-in attempts against more than 2,250 tenants. The ARTEX-driven activity began in early September, according to Microsoft.
A separate password spray ran from 10 to 14 October against 327 accounts at eight organisations. Microsoft logged more than 151,000 failed sign-ins, peaking at 2,900 failures per minute on 11 October. None of those attempts succeeded.
The route that worked went through the vendor. Storm-0940 used stolen ConnectWise application credentials to authenticate into customer tenants with no interactive user sign-in. From there it ran reconnaissance through Microsoft Graph, added credentials to existing OAuth apps and tried to change privileges. One ConnectWise management app assigned itself Global Administrator. In some environments Microsoft saw bulk secret reads across several Azure Key Vaults.
Microsoft said most targeting failed. Even so, the group achieved privileged cloud persistence at many organisations in a short time, and credentials added to other apps can survive after the compromised app is switched off.
What is ARTEX?
Microsoft described ARTEX as a multi-agent system of LLM-driven agents with a Go backend and a Next.js front end. It works with any AI model and runs a penetration test from reconnaissance through data exfiltration, building a graph of the assets and weaknesses it finds.
ARTEX was published as open source. CrowdStrike linked it on 7 October to a campaign against South Korean banks, and the developer then said there would be no further releases and reportedly closed the source, according to a Cloud Security Alliance research note. Forks had already appeared. Closing a repository does not recall the copies.
How did ConnectWise respond?
ConnectWise disclosed unauthorised access to application identities on 16 October, suspended Cloud Backup and took its SaaS Security and Cloud Management services offline. CEO Manny Rivelo said containment on the ConnectWise side does not remove access that may already exist inside individual customer tenants.
Huntress, which monitors many affected tenants, confirmed unauthorised sign-ins in 162 tenants by 19:00 UTC on 16 October. It later reported sign-in activity from the same IP address in almost 1,000 Entra tenants, with more than 300 successful.
Which defences actually help?
Start with OAuth and app credentials, because that is where the persistence lives. Search for vendor apps by application ID, not display name. Look for client secrets and certificates added since 13 October that nobody on your team created, and for service principals that assigned themselves directory roles.
Phishing-resistant MFA such as FIDO2 keys for admins blunts the password spray stage. It does nothing for app-only authentication, which is how the backup app path worked. That is the uncomfortable part. Least privilege on multi-tenant app permissions matters more here than another MFA prompt.
Review conditional access too. Huntress flagged exclusions that let vendor apps skip location-based blocks. Those exceptions were made for convenience and nobody revisits them.
Finally, automate containment. Against an attacker on a three-hour clock, a ticket in a queue loses. A pre-approved playbook that disables a suspicious service principal and alerts a human is the minimum.
The tooling is public, forks are in circulation and three hours is now the number defenders have to beat. Expect more vendors in the middle of these attacks, not fewer.
Quick answers
Who is behind the ConnectWise Cloud Backup attack?
Microsoft attributed it to Storm-0940, a China state-aligned group active since at least 2021. ConnectWise's CEO said the attack appears to come from a China state-aligned group.
What is ARTEX?
ARTEX is a multi-agent penetration testing framework with a Go backend that can use any AI model to run an attack from reconnaissance to data exfiltration. It was released as open source.
What should Microsoft 365 admins check first?
Search by application ID for ConnectWise or SkyKick apps, disable rather than delete them, preserve logs, and review credential additions, role assignments and consent grants back to at least 1 October.
