{"slug": "microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants", "title": "Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants", "summary": "China-aligned attackers tracked as Storm-0940 used an open source AI penetration-testing tool called ARTEX and compromised ConnectWise application credentials to attempt authentication against more than 2,250 Microsoft 365 tenants, Microsoft disclosed in an October 21 security blog post. Microsoft said the group made over 151,000 failed sign-in attempts against 327 accounts at eight organizations between October 10 and 14, then shifted to the stolen ConnectWise application identities, reaching up to 2,900 attempts a minute and gaining privileged cloud access in some environments in under three hours. ConnectWise CEO Manny Rivelo said the company had contained the affected application connections and was gradually restoring Cloud Backup, SaaS Security, and Cloud Management services, while Microsoft did not disclose how many customers were compromised or whether data was stolen.", "body_md": "# Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants\n\n[The Register](https://www.theregister.com)\n\nAI agents did the dirty work, with hackers gaining privileged access in some environments in under three hours\n\nChina-aligned attackers used AI agents and compromised ConnectWise application credentials to target more than 2,250 Microsoft 365 tenants, Microsoft says.\n\nThe Windows giant [revealed this week](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/) that the attackers, tracked as Storm-0940, used an [open source AI](https://www.machinebrief.com/glossary/open-source-ai) penetration-testing tool called ARTEX to automate attacks against Microsoft 365 environments. In some cases, they went from picking a target to gaining privileged cloud access in less than three hours.\n\nThe findings shed more light on the [ConnectWise security incident](https://www.theregister.com/security/2026/10/19/connectwise-turns-off-its-saas-y-backup-security-and-management-services-to-probe-security-snafu/5303758), which saw the IT management vendor pull the plug on its Cloud Backup, SaaS Security, and Cloud Management services after discovering unauthorized access to application identities.\n\nConnectWise didn't initially identify who was responsible, but Microsoft has now pointed the finger at Storm-0940, a China-linked espionage crew that's been operating since at least 2021.\n\nThe group has traditionally relied on the usual tricks, including password spraying and exploiting internet-facing applications, but this time it used AI to do some of the heavy lifting.\n\nARTEX is an open source penetration-testing framework written in Go that uses AI agents to automate everything from reconnaissance and vulnerability discovery to credential attacks and data theft. Microsoft says Storm-0940 began using it as early as September to target organizations worldwide, including government agencies, defense contractors, banks, manufacturers, and tech firms.\n\nBetween October 10 and 14, the hackers made more than 151,000 failed sign-in attempts against 327 accounts at eight organizations. Microsoft observed no successful logins from that password-spraying campaign, but then the attackers shifted to compromised ConnectWise application identities.\n\nThe compromised application credentials let the attackers exploit permissions customers had already granted to ConnectWise services, without needing an interactive user login.\n\nArmed with ARTEX, Storm-0940 attempted to authenticate against more than 2,250 Microsoft 365 tenants, at times reaching 2,900 attempts a minute. Microsoft also observed AI-accelerated activity through Microsoft Graph, including reconnaissance, application credential changes, and attempts to modify privileges, potentially allowing the attackers to stick around even after the original credentials were revoked.\n\nMost attempts failed, though Microsoft says the hackers still managed to establish persistent privileged access at numerous organizations. It hasn't disclosed how many customers were compromised or whether any data was stolen, cautioning that a successful login doesn't necessarily mean information was accessed.\n\nConnectWise CEO Manny Rivelo said the company had contained the affected application connections and was gradually restoring services, although shutting down those connections wouldn't necessarily boot out attackers who had already established a foothold in customer environments.\n\nConnectWise has been here before. In May 2025, [it admitted](https://www.theregister.com/security/2025/05/30/connectwise-compromised-by-sophisticated-nation-state/877470) that a \"sophisticated nation-state actor\" had broken into its systems and compromised a small number of customers using its ScreenConnect remote access software. There's nothing to suggest the two attacks are linked.\n\nNor is Storm-0940 alone in making use of ARTEX. Microsoft says it has spotted attackers from several geographic regions using the framework, which is freely available for penetration testing.\n\nThe underlying techniques are nothing new – stolen credentials, password spraying, and application abuse – but Microsoft says AI helped Storm-0940 execute them faster, with some attacks progressing from initial targeting to privileged cloud access in under three hours. ®\n\nGet AI news in your inbox\n\nDaily digest of what matters in AI.", "url": "https://wpnews.pro/news/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants", "canonical_source": "https://www.machinebrief.com/news/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-wmqc", "published_at": "2026-10-22 11:28:00+00:00", "updated_at": "2026-10-22 13:15:12.787776+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "artificial-intelligence"], "entities": ["Microsoft", "ConnectWise", "Storm-0940", "ARTEX", "Microsoft 365", "Manny Rivelo", "Microsoft Graph", "ScreenConnect"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants", "markdown": "https://wpnews.pro/news/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants.md", "text": "https://wpnews.pro/news/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants.txt", "jsonld": "https://wpnews.pro/news/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants.jsonld"}}