Microsoft: China-Linked Hackers Used AI Agents to Breach ConnectWise Tenants

A China-aligned hacking group used an agentic AI framework to turn a compromised vendor application into a path into more than 2,250 Microsoft 365 tenants, Microsoft Threat Intelligence said on October 21. In some cases the attackers reached privileged cloud access within three hours of first targeting a victim. For enterprise leaders, the incident is one of the clearest public examples yet of AI agents running an intrusion at a pace that human-driven security operations were not designed to match.

What happened in the ConnectWise attack?

Microsoft attributed the campaign to Storm-0940, a group it describes as China-state aligned and active since 2021, with a history of password spraying, exploiting internet-facing applications and abusing OAuth applications. Microsoft assessed that the group was behind the supply chain compromise of ConnectWise Cloud Backup, a multi-tenant cloud backup application.

According to Microsoft's timeline, ARTEX-driven attacks began as early as September and targeted hundreds of organizations. Between October 10 and 14, infrastructure tied to the group ran a password spray against 327 accounts at eight organizations, logging more than 151,000 failed sign-ins and peaking at about 2,900 failures per minute on October 11. Public reports of the ConnectWise compromise surfaced around October 15, and Microsoft said the group had gained control of the identities of several ConnectWise cloud applications. ConnectWise posted its first advisory on October 16, CSO Online reported.

With those application identities, the agents could authenticate to customer environments that had already granted the apps access, so no interactive user login was needed. Microsoft recorded more than 200 sign-ins in under four minutes using four application credentials. Most attempts against the 2,250-plus tenants failed. But in some tenants the agents moved on to Microsoft Graph reconnaissance, added credentials to applications and changed users, groups and privileged roles. Microsoft stressed that the activity did not stem from a flaw in its own products.

What is ARTEX, and how did the agents work?

Microsoft describes ARTEX as a multi-agent penetration testing framework built on large language models that can run from reconnaissance to data exfiltration with little human input. Sources differ on its licensing status: Microsoft calls it open source, while The Hacker News reported that it was made closed source after earlier abuse against South Korean financial institutions.

The Hacker News also cited Zscaler research on one ARTEX deployment configured to call a DeepSeek model through an OpenAI-compatible gateway, with other configurations specifying DeepSeek, GLM and Grok models; the same toolkit included a prompt history from Anthropic's Claude Code. Prompts split investigative tasks across models and had them check one another's findings. Zscaler judged the activity likely to be financially motivated, based on prompt histories that sought bulk personal and transaction data and payment gateway keys.

ConnectWise temporarily shut down affected services and is restoring them in phases, The Hacker News reported, describing the activity as part of a campaign that extends well past a single vendor.

Why does this matter for enterprise security teams?

Two features of the attack should concern any CIO or CISO. The first is speed. Microsoft said the speed of the activity left defenders very little time to respond. Yih Khai Wong of IDC Asia/Pacific told CSO Online that containment steps such as revoking tokens and isolating service principals should fire automatically at preset thresholds, arguing that "relying on a human to click 'approve' will not cut it."

That echoes what security leaders have been telling AI Connect audiences. "AI-powered defense mechanisms are essential to AI-powered attacks," Sundari Parekh, Global Deputy CISO at TrendAI, said at COLLIDE 2026, in a session on how AI agents are accelerating social engineering.

The second is the target: machine identities. The attackers did not need to phish an employee. They rode trusted vendor integrations that already held permissions across thousands of tenants. Security Brigade's Yash Kadakia put it bluntly to CSO Online, saying organizations have built zero trust for people while still implicitly trusting machines. The same logic applies to the AI agents enterprises are now deploying internally, each of which carries its own credentials and scopes. AI Connect speakers have made that case repeatedly, from IBM's warning about agent sprawl and the need for a control plane to Rubrik's argument that agents will overreach unless controls follow context.

What should organizations do now?

Microsoft's guidance for affected customers is specific. Keep the ConnectWise connections disabled until the vendor issues restoration steps. Do not delete the enterprise applications first, because that can destroy evidence. Search every tenant for the affected application IDs rather than display names, preserve Entra, Purview and SIEM logs, and review activity from at least October 15, and from October 1 where records allow. Then audit for new credentials, new service principals, consent grants and privileged role changes, since Microsoft warned that added application credentials can persist as a backdoor after the original app is fixed. Microsoft also cautioned that the presence of an affected app, or even a successful sign-in, does not by itself prove data was taken.

Beyond the immediate cleanup, the incident is a prompt to inventory every third-party application with tenant-wide permissions, apply least privilege to multi-tenant apps and test that revocation actually works. The next thing to watch is how quickly ConnectWise completes its restoration and whether other vendors disclose similar ARTEX-driven activity. Either way, defenders now have a documented case of an AI-agent attack moving from first contact to privileged access in an afternoon.

Frequently asked questions

What is ARTEX?

Microsoft describes ARTEX as a multi-agent, LLM-based penetration testing framework that can run an attack from reconnaissance to data exfiltration with little human input.

Was Microsoft itself breached?

No. Microsoft said the activity did not result from a compromise of, or vulnerability in, its own systems. Attackers used compromised ConnectWise Cloud Backup application identities.

What should affected organizations do first?

Keep ConnectWise connections disabled, preserve Entra, Purview and SIEM logs, search tenants by the affected application IDs, and audit for new credentials and privileged role changes before removing applications.

Filed under: Security & Fraud, Agentic AI, AI Governance & Trust