AI agents drove a China-linked attack on 2,250 Microsoft 365 tenants via ConnectWise
24 October 2026
Microsoft says Storm-0940 used the agentic pentest framework ARTEX with stolen ConnectWise app credentials to sign in to customer tenants without any user login, sometimes reaching privileged access in under three hours. Any tenant that ever authorised ConnectWise Cloud Backup should check for added credentials and role changes.
Incident status
- Active
- Contained
- Patch out
- Resolved
What to do
- Keep the ConnectWise Cloud Backup, MS Teams and MS Graph apps disabled until ConnectWise gives restoration steps, and search for them by application ID, not display name, including in tenants that no longer use them
- Preserve Entra sign-in and audit logs before deleting anything, then review service principal sign-ins back to 1 Oct (they don't show in the default user sign-ins view)
- Look for new app credentials, consent grants, owners and privileged role assignments added since mid-October, and remove confirmed unauthorised ones
- Revoking user sessions alone doesn't end app-only access; rotate any secrets the apps could reach
Timeline
- 24 October 2026ConnectWise is restoring services in phases; Wiz reports the group is now also spraying Okta and Entra ID logins at other software firms.
- 21 October 2026Microsoft attributes the campaign to China-aligned Storm-0940 and says ARTEX AI agents automated reconnaissance, password spraying and OAuth app abuse across more than 2,250 tenants.
- 17 October 2026Huntress confirms unauthorised sign-ins in 173 tenants; ConnectWise shuts off Cloud Backup app access.
- 15 October 2026Attackers begin using compromised ConnectWise app identities to authenticate to customer Microsoft 365 tenants.
Based on reporting by Microsoft Security. Read their full coverage for details.