AI-powered ConnectWise attack: Microsoft says Storm-0940 targeted more than 2,250 cloud tenants

A cloud backup provider needs access to customer data to perform its job. Organizations grant that access through application identities and permissions, allowing scheduled operations to run without requiring an employee to approve every request.

This trust relationship becomes a critical security dependency if the provider's credentials are stolen.

Microsoft says attackers associated with Storm-0940 exploited compromised ConnectWise Cloud Backup application identities and used an agentic AI framework called ARTEX to accelerate authentication attempts and follow-on activity across Microsoft 365 environments.

The findings were published on October 21 by Microsoft Security Research and Microsoft Threat Intelligence.

The investigation links earlier automated activity to the ConnectWise incident discovered in mid-October. It also describes successful privileged access in multiple environments, although that does not establish that every targeted tenant suffered data theft.

ARTEX automates existing offensive security techniques

ARTEX is an AI-enabled penetration testing framework. It coordinates multiple agents driven by language models to perform security assessment tasks.

The framework is written in Go and uses a Next.js interface. Microsoft says it can work with different AI models and automate activities ranging from reconnaissance to later stages of an intrusion.

Authorized penetration testing can use similar techniques to identify security weaknesses. The same capabilities become malicious when deployed against systems without permission.

ARTEX allows operators to coordinate different tasks, interpret intermediate results and continue working with relatively little human intervention.

The tool can also organize discovered systems, accounts and vulnerabilities into a graph, helping its agents maintain context as the investigation progresses.

Traditional security automation already existed before generative AI. The important change is the integration of planning, analysis and task execution within a workflow that can operate continuously.

Microsoft says Storm-0940 used this approach against hundreds of organizations across industries including aerospace, defense, finance, government, manufacturing, energy and technology.

In several observed operations, the attackers reached privileged cloud access in less than three hours.

That figure describes particular cases identified by Microsoft, not a guaranteed time to compromise every target.

More than 151,000 failed sign-ins did not produce a successful login

Between October 10 and October 14, Microsoft observed a password-spraying campaign associated with Storm-0940.

Password spraying involves trying passwords against multiple accounts rather than repeatedly attacking only one identity.

Microsoft recorded more than 151,000 failed authentication attempts targeting 327 accounts across eight organizations.

Activity peaked on October 11 at approximately 2,900 failures per minute. More than 111,000 failures were recorded within a single day.

Those numbers show the scale of automation, but they should not be confused with successful compromises.

Microsoft says this specific set of password-spraying attempts produced no successful authentication, token issuance, Microsoft Graph call or directory change.

The outcome was therefore a high-volume unsuccessful login campaign, rather than 151,000 breached accounts.

The attackers gained a more consequential avenue of access through the compromised ConnectWise application identities.

The ConnectWise compromise expanded the potential reach

Reports of unauthorized activity involving ConnectWise Cloud Backup began circulating around October 15.

The service, formerly known as SkyKick, provides cloud backup capabilities for Microsoft 365 customers through managed service providers and other partners.

Microsoft connected the indicators associated with this incident to infrastructure observed in the earlier Storm-0940 campaign.

After gaining control of multiple application identities, the attackers used the associated credentials to attempt authentication in customer Microsoft 365 environments.

Microsoft says the activity reached more than 2,250 tenants.

A tenant is a distinct Microsoft 365 administrative environment. It is not necessarily equivalent to one company or one confirmed victim of data theft.

The reported number represents the breadth of attempted access, not a verified count of organizations whose information was stolen.

The multi-tenant application model is central to the incident. A single vendor can be trusted by many organizations, making its credentials valuable to an attacker.

Microsoft's infographic also highlights more than 200 sign-ins in under four minutes using four application credentials.

These events should be distinguished from the earlier unsuccessful password-spraying campaign. The two sets of figures describe different phases and types of activity.

Application identities bypass the need for an interactive user login

Microsoft Entra allows authorized applications to access selected Microsoft 365 resources through service principals and application permissions.

For a backup service, this arrangement enables automated operations to continue without an administrator manually signing in each time.

If attackers obtain valid application credentials, they can attempt to exercise the permissions already granted to the service.

That creates a potential access path without compromising an individual employee's password.

Microsoft stresses that the activity described in its investigation did not result from a compromise of or a vulnerability in Microsoft's own corporate systems, products or services.

The attackers exploited trust granted to third-party applications and the credentials used to exercise that trust.

Microsoft observed activity through Microsoft Graph, the API used to interact with Microsoft 365 resources and directory information.

This included reconnaissance, attempts to change privileges and modifications to application credentials.

In some environments, the changes created opportunities for persistent access beyond the original compromised integration.

Cloud persistence can survive the original containment

Disabling a compromised application connection can prevent further authentication through that route.

It does not necessarily reverse changes that were made inside a customer tenant while the attackers had access.

A threat actor might add credentials to another application, modify a service principal or alter privileged role assignments.

Where such changes have occurred, access may continue even after the initial application credentials are revoked.

This is why Microsoft emphasizes investigating cloud persistence rather than treating vendor-side credential rotation as complete remediation.

Its researchers observed privileged follow-on activity in multiple customer environments.

However, not every targeted tenant experienced the same outcome.

Microsoft explicitly cautions that a successful authentication does not automatically establish that customer data was accessed or exfiltrated.

Investigators must distinguish attempted access, successful authentication, unauthorized directory changes and confirmed data access.

The public reporting does not provide a comprehensive count of affected customers with verified data exfiltration.

ConnectWise suspended three integrated services

ConnectWise says it detected suspicious activity on October 14 and issued its first public advisory on October 16.

The company identified unauthorized access involving application identities associated with Cloud Backup.

On October 17, it disabled affected connections and revoked credentials used by the relevant applications.

As a precaution, ConnectWise suspended Cloud Backup, SaaS Security and Cloud Management.

The interruption affected scheduled backups, access to archives, restoration operations and some management and security monitoring capabilities.

That service disruption matters because backups are a key part of an organization's recovery capabilities.

ConnectWise says existing backup archives remain encrypted, isolated and preserved, with no indication that they were compromised.

The statement applies to the backup archives within its infrastructure.

It does not establish that every customer Microsoft 365 environment was unaffected.

ConnectWise acknowledges that its own investigation cannot fully determine whether unauthorized activity occurred within each customer tenant.

Partners and customers must review those environments separately.

Restoration has started, but the incident is not fully resolved

ConnectWise completed a reset of accounts and credentials in the affected Cloud Backup environment on October 19.

On October 21, the company announced that it had begun restoring services in controlled phases.

Its October 22 update confirmed that restoration remains underway, with each phase subject to security validation.

ConnectWise expects the process to take several days.

Beginning restoration does not mean all capabilities are available again.

The company has instructed partners to keep affected application connections disabled until the relevant reconnection procedures are formally issued.

It also says there is currently no indication that other ConnectWise products or services are affected by this incident.

These statements describe the findings available at the time of the latest updates, not a final guarantee concerning every customer environment.

What Microsoft 365 administrators should investigate

Microsoft and ConnectWise both recommend tenant-level investigation for organizations that authorized the affected integrations.

Administrators should identify relevant application registrations and service principals, including legacy integrations that may no longer be actively used.

Searching by application identifiers is more reliable than relying solely on display names.

Microsoft advises reviewing service-principal sign-ins, application credentials, audit records and Microsoft Graph activity.

Investigations should look for unusual authentication sources, newly added credentials, privilege changes, unexpected application owners and modifications to permissions or consent grants.

The recommended review period begins no later than October 15. Where logs are available, Microsoft suggests extending the investigation back to October 1.

Administrators should also examine indications of unusual mailbox or file access and other resource activity.

An important recommendation is to preserve evidence before making irreversible configuration changes.

Microsoft specifically advises against immediately deleting enterprise applications as the first response because this can make investigations more difficult.

Verified unauthorized credentials, role assignments or access grants still need to be removed through appropriate incident-response procedures.

Published indicators of compromise can guide investigation, but a matching indicator does not automatically prove a breach, and the absence of known indicators does not conclusively rule one out.

AI compresses the time available for defenders

Storm-0940 did not invent password spraying, OAuth application abuse or cloud persistence.

Those techniques were already established components of offensive security operations.

ARTEX allowed the attacker to execute and coordinate familiar techniques at greater speed and scale.

An AI agent can interpret reconnaissance results, identify potential next steps and continue working across multiple targets without waiting for every decision to be made manually.

This creates a problem for defenders whose response procedures depend on analysts reviewing alerts in sequence.

An alert may be generated correctly but arrive too late to prevent additional credential or permission changes.

Microsoft's observation of privileged access achieved in less than three hours in multiple operations illustrates the challenge.

Automated security response can help, but the underlying access model remains equally important.

Third-party applications should receive only the permissions required for their intended functions, and organizations need visibility into how those permissions are used.

Credential rotation, privileged role monitoring and the investigation of anomalous application-only activity are central controls in this type of incident.

Attribution remains contested, while the technical findings are documented

Microsoft tracks Storm-0940 as a China-state aligned actor active since 2021.

Reuters reported that the Chinese Embassy in Washington rejected allegations against China and reiterated that the country opposes unlawful hacking.

The state-alignment assessment is Microsoft's attribution.

The observed authentication attempts, compromised application identities and cloud directory activity are separate technical findings documented through Microsoft's investigation and ConnectWise's incident communications.

ConnectWise says the available evidence, including Microsoft threat intelligence, is consistent with its assessment of the attack.

The larger lesson is about the trust placed in third-party cloud applications.

A provider can contain compromised credentials and begin restoring its own systems while customer environments still require independent checks for persistent unauthorized access.

As of October 22, ConnectWise's phased restoration is ongoing, stored backup archives show no public indication of compromise, and potentially affected Microsoft 365 tenants still require investigation.

The precise extent of unauthorized customer data access has not been publicly established.