By Thomas Anderson in Security News — 22 Oct 2026

Microsoft Attributes the ConnectWise Supply-Chain Attack to Chinese State Hackers — Storm-0940 Aimed ARTEX AI Agents at Stolen App Identities Across 2,250 Microsoft 365 Tenants

Microsoft disclosed on October 21 that a China state-aligned actor it tracks as Storm-0940 was behind the recent supply-chain compromise of ConnectWise's Cloud Backup platform — and that the attackers ran the operation with ARTEX, a Go-based agentic AI penetration-testing framework that went closed-source after it was abused in attacks on South Korean financial institutions. Microsoft says the AI agents worked at "machine speed," automating reconnaissance, password spraying, and OAuth application abuse against hundreds of organizations worldwide since September 2026, across sectors from aerospace and defense to energy, government, legal, manufacturing, media, and semiconductors.

The incident ConnectWise itself disclosed began on October 14, when its monitoring flagged unauthorized access to several of its cloud application identities. On October 17 at 07:00 UTC the company disabled seven application identities — ConnectWise Cloud Backup plus six Cloud Management variants (MS Teams, Exchange Online, MS Graph, Partner Center, SharePoint Online) — revoked the certificates behind affected connections, suspended the Cloud Backup service, and took SaaS Security and Cloud Management offline as a precaution. The danger of the technique is structural: an attacker holding an application's credential does not need any customer's password. They authenticate as the trusted application, request access tokens from Microsoft Entra ID based on the permissions the app already holds, and reach whatever that app can reach — mailboxes, SharePoint, Teams, directory data.

Microsoft's telemetry shows the mechanics. Between October 10 and 14, Storm-0940 infrastructure at 144.172.64[.]99 ran an automated cross-tenant password-spray campaign against 327 accounts across eight organizations — more than 151,000 failed logons, peaking at 2,900 failures per minute on October 11, with no successful authentication. On October 15, the AI agents gained control of the identities of multiple ConnectWise cloud applications and began authenticating into customer environments through the trust those apps already held — Microsoft observed attempts against more than 2,250 tenants, and in several cases the actors moved from initial targeting to privileged cloud access in under three hours, adding client secrets to trusted applications and modifying app credentials so their persistence survives revocation of the original stolen credential.

Recorded Future, tracking the ARTEX operators as TAG-217, dates related activity to August 17; Zscaler ThreatLabz found a custom ARTEX deployment configured to use DeepSeek through an OpenAI-compatible gateway, with configurations also specifying GLM and Grok — and prompt histories instructing models to divide tasks and review one another's work. Those histories show requests for bulk personal and transaction data and questions about selling stolen data, suggesting the wider campaign is financially motivated. ConnectWise, which has been restoring services in phases, said the activity "describes a campaign that reaches well beyond any one company" and warned that MSPs are both targets in their own right and a path into every client they serve.

What Should You Do?

If you use ConnectWise Cloud Backup, SaaS Security, or Cloud Management — follow the vendor's trust-center advisories and status updates, complete its credential-reset process as services come back, and verify tenant integrity before reconnecting.
Audit Entra ID for the persistence pattern — new client secrets on existing applications, unfamiliar OAuth apps, permission grants, and credential modifications you did not make. These backdoors survive revocation of the original credential and are the thing to hunt after a vendor breach.
Treat third-party application identities as privileged accounts — inventory every vendor app with tenant access, constrain what it can do, and review its non-interactive sign-in activity like admin activity.
Alert on machine-speed patterns — password-spray bursts (thousands of failures per minute), cross-tenant sign-in attempts from unfamiliar infrastructure, and non-interactive authentications by service principals are the visible signature of agentic attacks like this one.

The WAF Angle

Nothing in this attack looks like classic web attack traffic — no SQLi, no payloads, just valid token requests from an application your tenant already trusted. The pattern rhymes with the OpenAI agents that flooded RubyGems and with the PoeLLM botnet harvesting exposed AI infrastructure: AI agents lower the cost of abusing trust relationships at scale, and identity is the perimeter they attack. Web defenders should mirror their tenant's third-party app inventory into monitoring, because the request that ends your organization may be a perfectly valid OAuth token call from an app the business trusted yesterday.

Microsoft Attributes the ConnectWise Supply-Chain Attack to Chinese State Hackers — Storm-0940 Aimed ARTEX AI Agents at Stolen App Identities Across 2,250 Microsoft 365 Tenants