A recent assessment by Microsoft has revealed that a Chinese nation-state actor, identified as Storm-0940, was responsible for breaching Microsoft 365 tenants utilized by ConnectWise, which consequently led to the IT management software provider taking several of its cloud services offline. This alarming breach highlights growing concerns over cybersecurity vulnerabilities associated with third-party software supply chains.
Beginning in September 2026, the threat actor employed an advanced penetration testing framework known as ARTEX, using agentic artificial intelligence to target and compromise hundreds of organizations across various industries on a global scale. Industries affected included critical sectors such as aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, technology, and various think tanks and non-profits.
Microsoft noted that Storm-0940 has been active since at least 2021, with data theft being its primary objective. To initiate attacks, the group commonly utilizes tactics such as password spraying and exploiting internet-facing applications for initial access. Once inside, they establish long-term access to cloud environments by modifying existing OAuth applications and adding new credentials to maintain their foothold.
### Attack Strategy and Impact on ConnectWise Customers
Upon gaining unauthorized access to ConnectWise’s multi-tenant application, the China-aligned group launched an aggressive campaign targeting the firm’s downstream customers. Utilizing the ARTEX platform, they engaged in accelerated scanning, reconnaissance, and password spraying, attempting to log into more than 2,250 tenants at a staggering rate of 2,900 sign-in attempts per minute. This rapid pace of attack significantly challenges defenders, offering little opportunity for timely detection and response.
Further investigations revealed that Microsoft identified several customer environments showing evidence of follow-on activities such as reconnaissance, application credential modifications, and unauthorized changes involving identities, groups, and privileged roles. In a blog post dated October 21, Microsoft elaborated that after obtaining control of multiple ConnectWise cloud applications’ identities, the AI agents operating on behalf of the threat actor continued to authenticate to customer environments using the illicit access acquired through compromised app credentials. This effectively exploited the existing trust established by these applications within tenant networks.
In an advisory published on October 21, ConnectWise confirmed the findings presented by Microsoft, acknowledging the extensive use of AI to penetrate its Microsoft 365 tenants. The firm remarked, “Nation-state actors are increasingly targeting the software supply chain, because one trusted connection can open the door to many organizations. AI now allows them to test these connections at what Microsoft describes as ‘machine speed.’ Managed Service Providers (MSPs) find themselves sandwiched in this supply chain, making them targets in their own right while simultaneously becoming pathways for breaches into their clients’ systems.”
### Ongoing Investigation and Service Downtime
ConnectWise first detected suspicious activity within its network on October 15, 2026, and by October 17, it confirmed unauthorized access to application identities in its Cloud Backup environment. The ramifications of this breach prompted the firm to take several services offline, including its Cloud Backup (formerly known as SkyKick), SaaS Security, and Cloud Management offerings, as a precautionary measure while investigations commenced.
Currently, these services remain offline, as noted on the company’s status page. However, a phased restoration process for the Cloud Backup service began on October 22, with the company informing customers that the restoration might take several days. The company pledged to provide specific service availability and reconnection instructions once confirmed, meanwhile urging customers to keep all affected connections disabled until formal instructions are issued.
Despite the unsettling circumstances, ConnectWise maintained that existing backup archives remain encrypted, isolated, and intact, with no evidence of compromise detected. Additionally, no indications have emerged suggesting that other products and services offered by ConnectWise were adversely impacted by this incident. The firm has stressed the importance of its customers reviewing their individual Microsoft 365 tenants for any unauthorized changes or potential persistent entry points used by attackers.
### The Threat of ARTEX Agentic AI Platform
The ARTEX platform is significant in its capacity to execute a variety of offensive security workflows, automating penetration testing processes from reconnaissance to data exfiltration. During assessments, the agents compile discovered assets and vulnerabilities into a comprehensive graph, providing a structured overview of potential exploit avenues.
While the platform defaults to English for user interaction, it can be adjusted to other languages including Korean, Mandarin, Spanish, and Japanese, thus broadening its accessibility to various threat actor groups globally. Notably, CrowdStrike reported in October 2026 that a Chinese hacker used ARTEX to identify vulnerabilities in South Korean financial institutions, leading to a successful data exfiltration campaign.
The recent breach involving ConnectWise not only underscores the effectiveness of AI-driven attacks by state-sponsored entities but also emphasizes the urgent need for enhanced cybersecurity measures, particularly in the software supply chain. As organizations increasingly rely on interconnected systems, the importance of vigilance and robust defense strategies grows ever more critical.