Microsoft said on 21 October 2026 that Storm-0940, a group it describes as China-state aligned, used an agentic AI attack framework called ARTEX to automate attacks on hundreds of organisations, and that it assesses the same group was behind the ConnectWise Cloud Backup supply-chain compromise disclosed days earlier. The AI agents tried to sign in to more than 2,250 Microsoft 365 tenants. If an IT provider manages your Microsoft 365, now is the time to ask what it has connected to your tenant.
What happened
Microsoft Security Research and Microsoft Threat Intelligence published the report, AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise, on 21 October 2026. It joins two stories: a password-spray campaign against Microsoft 365 accounts, and the break-in at ConnectWise's cloud backup service.
ConnectWise Cloud Backup, formerly SkyKick, is used mainly by managed service providers (MSPs, the IT firms that look after other businesses' systems) to back up their clients' email, files and Teams data. iTnews reported on 18 October 2026 that a stolen credential let attackers sign in to customers' Microsoft 365 environments, and that ConnectWise switched the service off. Microsoft says ConnectWise published its initial advisory on 16 October 2026 and later expanded its containment guidance.
The Register reported on 19 October 2026 that ConnectWise also suspended its SaaS Security and Cloud Management services, which are integrated with Cloud Backup, "out of an abundance of caution". The Register noted that the suspension does not mean MSPs or their customers should assume they were compromised, and ConnectWise said it could not discuss attribution. Microsoft's report now supplies that attribution, as its own assessment.
The new part is how the attack was run. Microsoft says ARTEX is an open-source penetration testing framework that can use any AI model. Its AI agents carry out an attack from reconnaissance through to data exfiltration (copying data out) with little human involvement. Storm-0940 began using it as early as September 2026.
Key details
| Item | What Microsoft and the reports say |
|---|---|
| Who | Storm-0940, which Microsoft calls a China-state aligned actor active since 2021, focused on data theft |
| Tool | ARTEX, an open-source framework of AI agents that automates penetration testing workflows |
| Password spray | 10 to 14 October 2026: 327 accounts across eight organisations, more than 151,000 failed logons, no successful sign-in observed |
| ConnectWise phase | Sign-in attempts against more than 2,250 tenants at 2,900 attempts per minute, using stolen app credentials |
| Speed | In multiple cases, less than 3 hours from first targeting to privileged access |
| Microsoft products | Not the cause: no compromise of or vulnerability in Microsoft systems, products or services |
| Service status | ConnectWise switched Cloud Backup off; iTnews reported customers cannot restore data while it is offline |
Why it matters
The attackers did not need anyone's password for the second phase. Microsoft says that after taking control of the identities of several ConnectWise cloud applications, the agents logged in to customer tenants through apps that had already been granted access, "without requiring an interactive user sign-in". A backup tool needs wide access to everything it protects, so a stolen backup credential opens a lot of doors.
That is the supply-chain problem in one sentence: you can do everything right inside your own business and still be exposed through software your IT provider connected on your behalf. We covered the same pattern from another angle in our report on the N-able N-central alert, where the risk sat in the tool used to manage client computers.
In some tenants the agents went further. Microsoft says they ran reconnaissance, changed application credentials to keep their access, and altered identities, groups and privileged roles. iTnews reported that security firm Huntress saw one ConnectWise app give itself global administrator rights in a customer tenant and then add new passwords to two other apps, both set to last until 2028. Microsoft warns that changes like these can remain as a backdoor even after the original application is fixed.
The speed is the AI part of the story. Microsoft says most of the targeting failed, but Storm-0940 still achieved privileged cloud persistence at many organisations in a brief time, sometimes in under 3 hours. Someone reviewing alerts the next morning is already behind an attacker working at that pace. ASD's advice on how attackers hijack AI accounts and API keys, and OpenAI's own misalignment reports on test models getting past website security, point the same way: automated attackers keep going where a person would stop.
Microsoft also says an affected app in your tenant, or even a successful sign-in, does not necessarily mean your data was accessed or taken. ConnectWise said it found no evidence that stored backups were accessed.
What this means for businesses
What most small and medium businesses have is a Microsoft 365 tenant with a handful of third-party apps approved inside it, often by an IT provider years ago. That list is now worth a look.
A short checklist for owners and managers:
- Ask your IT provider in writing whether they use ConnectWise Cloud Backup, SaaS Security or Cloud Management for your business, now or in the past. Microsoft says to review every tenant where the apps are or were installed, even if the integration is no longer used.
- If the answer is yes, ask whether the connections are disabled and whether your tenant has been reviewed from at least 15 October 2026 for new app credentials, new apps, consent grants and changes to admin roles.
- Do not let anyone delete the apps in a hurry. Microsoft advises preserving settings and logs first, then having an authorised responder remove what is confirmed as unauthorised.
- Check your backups. With Cloud Backup offline, iTnews reported that customers cannot restore data, so make sure you have another copy of anything you cannot lose. Our guide to the 3-2-1 backup rule explains how to set that up.
- Ask for a list of every third-party app with access to your tenant, what each one can do, and who approved it. Microsoft recommends least privilege for these permissions: each app gets only what it needs.
- Keep the basics on. ASD's small business cyber security handbook starts with multi-factor authentication, up-to-date software and regular backups. They do not cover app permissions, but they close the doors the password-spray phase was knocking on.
If personal information was accessed, the Notifiable Data Breaches scheme may apply. The OAIC says an organisation covered by the Privacy Act must notify affected individuals and the OAIC when a breach is likely to cause serious harm, and a suspected breach should be assessed within 30 days at most. Our explainer on data breach obligations for small business in Australia covers who must notify. For a specific case, ask a lawyer or the OAIC.
Recruitment and HR teams have extra reason to look, because mailboxes and shared drives often hold CVs, references and ID documents. Our recruitment technology page covers how those systems connect. One option is to keep candidate checks out of the shared mailbox, in a candidate verification platform such as Talent Tabloid.
Our guide to what to expect from managed IT support lists the questions about access, logging and backups that matter here. If you would like someone outside the arrangement to review your tenant's apps and permissions, our cyber security service starts with a review of accounts, cloud services and backups. You can ask for a free first consultation, and you get a written quote before any work starts.
Frequently asked questions
Was Microsoft 365 itself hacked in the ConnectWise breach?
No. Microsoft says the activity did not come from a compromise of, or a vulnerability in, its own systems, products or services. The attackers got in through ConnectWise applications that customers had already approved to work inside their Microsoft 365 tenants.
What is ARTEX?
Microsoft describes ARTEX as an open-source penetration testing framework that can use any AI model. Its AI agents run an attack from reconnaissance through to data theft with little human help, which is what let Storm-0940 work at machine speed.
Does an affected app in our tenant mean our data was stolen?
Not necessarily. Microsoft says an affected application being present, or even a successful sign-in, does not by itself show that customer data was accessed or taken. It does mean the tenant should be reviewed properly, from at least 15 October 2026.
Would multi-factor authentication have stopped this?
MFA protects people signing in, and it is still one of the first things to turn on. In this campaign Microsoft says the agents used apps that were already trusted, with no interactive user sign-in, so app permissions need their own review.
Should we delete the ConnectWise apps from our tenant?
Microsoft advises against deleting them as the first response. Keep the affected connections disabled, preserve the logs and settings as evidence, and let an authorised responder remove anything confirmed as unauthorised.
Key takeaways
- Microsoft says Storm-0940 used the ARTEX AI agent framework and assesses it was behind the ConnectWise Cloud Backup compromise.
- The agents signed in through already-approved apps, not staff passwords, and reached privileged access in under 3 hours in some cases.
- Microsoft's own products were not the cause, and an affected app does not by itself mean data was taken.
- Ask your IT provider whether ConnectWise apps touch your tenant, and whether it has been reviewed since 15 October 2026.
- Keep a second backup while Cloud Backup is offline, and review every third-party app's permissions.