Chinese state-aligned hackers used AI agents to target more than 2,250 organizations following a cyberattack on ConnectWise, an IT management and cloud backup provider. According to Microsoft, the attackers exploited stolen application credentials to attempt access to customers’ Microsoft 365 environments, conducting approximately 2,900 sign-in attempts per minute.
The findings, published on October 21, 2026, identified the hacking group as Storm-0940, which Microsoft tracks as a China state-aligned threat actor. The company said the attackers used an AI-powered framework called ARTEX to automate reconnaissance, authentication attempts, and other activities across corporate cloud systems.
Hackers Exploit ConnectWise Cloud Backup Credentials
According to Microsoft’s security research, attackers compromised application credentials associated with ConnectWise’s cloud services. These credentials allowed them to authenticate to customer environments through connections that organizations had previously authorized.
Once inside affected environments, the hackers could access Microsoft 365 resources, examine user accounts, and modify application permissions. Microsoft identified cases in which attackers established persistent access by adding credentials to existing applications, potentially allowing them to regain entry after the original security issue was addressed.
Microsoft said the campaign targeted organizations across aerospace, defense, energy, finance, government, manufacturing, technology, and other industries. Although most attempts were unsuccessful, investigators identified multiple organizations where the attackers gained privileged access to cloud infrastructure.
ARTEX AI Framework Accelerates Cyberattacks
Storm-0940 used ARTEX, an open-source AI penetration-testing framework, to automate activities normally performed by human security testers. Microsoft said the tool allowed attackers to conduct reconnaissance, test credentials, and exploit compromised application access at substantially higher speeds.
During one phase of the campaign, Microsoft recorded over 151,000 failed sign-in attempts targeting 327 accounts across eight organizations between October 10 and 14. Activity peaked at approximately 2,900 failed attempts per minute, although Microsoft found no successful authentication in that particular password-spraying operation.
Following the ConnectWise compromise, attackers attempted to access more than 2,250 Microsoft 365 tenants using stolen application credentials. Microsoft reported that some related intrusions progressed from initial targeting to privileged cloud access in less than three hours.
ConnectWise Suspends Services and Begins Restoration
ConnectWise confirmed the security incident and temporarily suspended access to affected cloud services while investigating unauthorized activity. The company subsequently began restoring services in controlled phases, subject to additional security checks.
ConnectWise said it had disabled affected application identities and reset credentials associated with its cloud backup environment. However, those measures may not remove unauthorized access that attackers established independently within customer systems.
Microsoft advised affected organizations to keep compromised application connections disabled until ConnectWise provides restoration instructions. It also recommended reviewing authentication logs, investigating changes to application permissions, and checking for unauthorized access to Microsoft 365 data.
The investigation remains ongoing, with ConnectWise working to restore affected services and determine the full impact on customers. Microsoft warned that the incident demonstrates how AI-assisted attacks can substantially reduce the time available for organizations to identify and contain intrusions.
Featured image credits: Magnific.com
For more stories like it, click the +Follow button at the top of this page to follow us.