Microsoft's threat researchers said on October 21, 2026 that a China state-aligned hacking group, tracked as Storm-0940, breached ConnectWise's cloud backup service, stole application credentials, and used AI agents to attempt sign-ins at more than 2,250 customer organizations, reading emails and files where they got in.
The speed is the story as much as the breach. The agents fired off about 2,900 sign-in attempts per minute, and in several cases went from picking a target to holding privileged cloud access in under three hours. Microsoft's verdict on that pace: it gives defenders "little time to detect and respond."
Graphic: the ConnectWise campaign at a glance. Sources: Microsoft Threat Intelligence reporting via TechCrunch, Reuters, and The Register, October 21-22, 2026. ByteHerald analysis.
How the breach worked
ConnectWise sells IT management and remote access software, including a cloud backup service (formerly SkyKick) that managed service providers use to back up their clients' Microsoft 365 and Google Workspace data. Between October 15 and 16, the attackers compromised that service. ConnectWise acknowledged the incident on October 16, saying it was "investigating recent attempts of unauthorized access associated with the ConnectWise Cloud Backup environment," Reuters reported.
What the attackers took was worse than customer data: they stole the application credentials ConnectWise uses to maintain data links with its customers. Those credentials let the group sign in to customers' Microsoft-hosted environments as if they were an authorized user, with no interactive user sign-in involved. Once inside, they read emails and files, and in some tenants went further: mapping directories, planting backdoor credentials, and changing privileged roles. One of Microsoft's detection alerts describes an application granting itself the Global Administrator role.
The ConnectWise opening was the second act. From October 10 to 14, the same group ran a password-spraying campaign: more than 151,000 failed sign-in attempts against 327 accounts at eight organizations, with zero successful logins, The Register reported from Microsoft's findings. Spraying failed. The stolen vendor credentials worked.
The AI agents did the scaling
The automation layer has a name: ARTEX, an open-source penetration-testing framework that plugs in any AI model and runs multi-agent LLM workflows from reconnaissance through data exfiltration. Microsoft described it as a system of LLM-driven agents that runs an autonomous penetration test "with little needed human interaction." It was released in July 2026 for legitimate security testing and went closed-source in October 2026 after misuse reports, according to CryptoBriefing's account of Microsoft's research.
Storm-0940 is not new. Microsoft tracks the group back to at least 2021, running password spraying and planting credentials inside applications that already hold standing access to company data. Since September, ARTEX automated that playbook. The same tooling was linked to a compromise of South Korean financial systems affecting roughly 68,000 individuals, many of which had weak security and no multi-factor authentication, TechCrunch reported.
The targets spanned aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, think tanks, and nonprofits, per Reuters. Microsoft cautioned that most targeting attempts failed, but said the group achieved privileged cloud persistence, access that can survive cleanup efforts, at many organizations in a brief time.
Reported downstream exposure for three vendor-compromise campaigns. Each number measures something different: installed updates, downstream businesses, targeted tenants. Sources: SolarWinds SEC filing via Dark Reading; Kaseya statement via SecurityWeek; Microsoft via The Register. ByteHerald analysis.
The pattern: one vendor, thousands of targets
ConnectWise is the third entry in a ledger the industry keeps rewriting:
| Campaign | The vendor opening | Downstream reach (as reported) | Attribution |
|---|---|---|---|
| SolarWinds, December 2020 | Trojanized Orion software updates | Fewer than 18,000 customers installed the tainted update, per the company's SEC filing | Russia's SVR, per US and UK assessments |
| Kaseya, July 2021 | REvil ransomware via a VSA zero-day, pushed through MSPs | Fewer than 1,500 downstream businesses, per Kaseya's statement | REvil ransomware group |
| ConnectWise, October 2026 | Stolen cloud-backup application credentials, scaled with AI agents | More than 2,250 Microsoft 365 tenants targeted, per Microsoft | Storm-0940, China state-aligned, per Microsoft |
Sources: Dark Reading on the SolarWinds filing; SecurityWeek on Kaseya's statement; The Register on Microsoft's ConnectWise findings.
The honest caveat first: these three numbers do not measure the same thing, so this is not a ranking. Installed updates, downstream businesses, and targeted tenants are different units. The point of the comparison is the shape of the risk, which is identical every time. IT vendors and managed service providers hold trusted, standing, privileged credentials across hundreds or thousands of customer environments. Breach the vendor once and you inherit its trust everywhere. That is why attackers keep picking this lock, and why AI agents make the picking faster: the 2021 Kaseya campaign needed a holiday weekend and manual ransomware deployment per victim; the 2026 campaign needed stolen credentials and agents firing 2,900 logins a minute.
What ConnectWise and Microsoft are telling customers
In an October 21 update to its advisory, ConnectWise said that "based on the evidence available to ConnectWise, including threat intelligence shared by Microsoft, it appears that a China state-aligned group was responsible for the attack on ConnectWise Cloud Backup." The company said it contained the affected application connections and began restoring services in phases after security checks. It also warned that restoring services does not automatically remove unauthorized access the attackers may have established inside individual customers' Microsoft 365 environments, which need separate investigation, Arab Times reported from the advisory.
Microsoft's guidance: keep ConnectWise application connections disabled until restoration instructions arrive, preserve evidence, review service principal sign-ins and audit records, and investigate unexpected credential or privilege changes. It added a caution worth keeping: a successful sign-in does not necessarily mean customer data was accessed or stolen. We catalogued the year's AI security incidents in our Assume Breach review; the ConnectWise campaign is the clearest 2026 case of the supply-chain row, and the first where AI agents did the downstream scaling.
What to watch next
Three open questions. First, whether the 2,250 figure grows as investigations complete, and whether data theft gets confirmed at named victims. Second, whether ARTEX's shift to closed-source slows copycats or just moves the tooling underground; dual-use security frameworks do not stay dual-use for long once they work this well. Third, ConnectWise's restoration timeline, and whether customers actually complete the separate tenant-level hunts the company says are required.
Until then, the record stands: one vendor's backup service, one set of stolen credentials, and AI agents fast enough that defenders get almost no time to react. The supply-chain playbook did not change. Its tempo did.
By ByteHerald Staff. Microsoft threat researchers' findings on Storm-0940's ConnectWise breach, published October 21, 2026 (China-aligned group, cloud backup service compromise, AI agents attempting sign-ins at more than 2,250 customer organizations, ARTEX framework). Reuters reporting, October 21, 2026. The Register's coverage of Microsoft's disclosure. TechCrunch reporting, October 22, 2026. CryptoBriefing on the ARTEX tooling. Historical comparison figures: SolarWinds (18,000 customers) via Dark Reading; Kaseya (1,500 businesses) via SecurityWeek.
Comments
Post a Comment