Microsoft Names Storm-0940 and ARTEX AI Agents Behind the ConnectWise Supply Chain Attack

Microsoft Threat Intelligence published its findings on October 21, 2026 in a Microsoft Security Blog report. It follows the earlier disclosure that ConnectWise had shut down Cloud Backup after attackers used trusted application access to reach customer Microsoft 365 tenants, which we covered in our earlier report on the ConnectWise breach.

What happened and what Microsoft attributed

Microsoft assesses that Storm-0940, a China-state-aligned actor active since 2021, was behind the compromise. It used ARTEX, an open-source multi-agent AI framework that can run penetration tests from reconnaissance to data exfiltration with little human input. Microsoft says other threat actors in different regions also use it.

• Early September 2026: Microsoft says the actor's ARTEX-driven activity began.
• October 10 to 14: a password-spray campaign targeted 327 accounts at eight organizations, with more than 151,000 failed logons at a peak of about 2,900 per minute, per Microsoft. Lockouts made up nearly 98% of that activity and Microsoft saw no successful sign-in in that campaign.
• October 15 and 16: public reports of the ConnectWise Cloud Backup compromise appeared, and ConnectWise published an initial advisory.
• Afterward: Microsoft says AI agents used stolen application credentials to attempt sign-ins at more than 2,250 tenants.

CyberScoop reported that ConnectWise temporarily shut down services over the weekend and began phased restoration on Wednesday, and advised customers to keep connections disabled, with recovery expected to take several days. CyberScoop's coverage and The Record's report both describe the attribution. Reported figures differ slightly between outlets, so this article uses Microsoft's numbers.

Why the ARTEX angle matters for IT teams

The notable shift is speed and scale. Microsoft says some intrusions reached privileged cloud access in under three hours after initial targeting. When AI agents handle reconnaissance, credential testing and persistence, defenders have less time between first contact and serious access.

Microsoft stresses that this did not stem from a vulnerability in Microsoft products. The attack relied on trusted third-party application access and stolen credentials. That makes it a supply chain problem: a vendor's multi-tenant app held permissions in many customer tenants, so one vendor compromise reached all of them.

• Where agents got in, they ran Microsoft Graph reconnaissance and changed application credentials to persist.
• Some environments saw attempts to modify identities, groups and privileged roles, and bulk reads of Key Vault secrets.
• Microsoft cautions that a successful sign-in does not prove data was accessed or exfiltrated.

What B2B SaaS buyers and MSPs should do now

Microsoft's guidance is to treat third-party apps with delegated permissions as a security boundary. Preserve evidence first, then review activity and permissions. The steps below summarize its recommendations; follow the original report for application IDs and hunting queries.

• Keep affected ConnectWise connections disabled until ConnectWise issues restoration instructions.
• Do not delete the enterprise applications first, because that destroys evidence. Preserve configuration, Entra sign-in and audit logs, and SIEM data.
• Search by application ID, not display name, in every tenant where the app was installed, even if unused.
• Review service principal sign-ins from at least October 15, and back to October 1 where logs exist, including unfamiliar source addresses.
• Audit credential additions, new service principals or owners, consent grants, privileged role changes and Conditional Access changes.
• After preserving evidence, revoke unneeded permissions and rotate credentials.
• Apply least privilege to multi-tenant apps and monitor high-privilege app activity.

Fold this into vendor risk management

This incident is a reminder to inventory every SaaS app that holds API access to your core platforms. The NIST cybersecurity supply chain risk management program and the NIST Cybersecurity Framework both treat supplier access as a risk to be governed, tested and monitored.

Ask backup, RMM and automation vendors which tenant permissions they need, how their application secrets are stored and rotated, and how fast they notify you of incidents. Review options in our SaaS backup software, identity and access management and SIEM categories. Backup customers can follow vendor updates at ConnectWise.

Frequently Asked Questions

Was Microsoft 365 itself vulnerable in the ConnectWise attack?
No. Microsoft says the activity did not result from a compromise of, or vulnerability in, its own systems, products or services. Attackers abused trusted third-party application access and stolen credentials from the ConnectWise cloud environment.

Should we delete the ConnectWise enterprise applications from our tenant?
Not first. Microsoft advises preserving configuration, sign-in and audit logs before any cleanup, keeping affected connections disabled, searching by application ID, and revoking permissions and rotating credentials only after evidence is saved.

How can we reduce risk from third-party SaaS integrations?
Inventory every multi-tenant app with delegated permissions, apply least privilege, monitor service principal sign-ins and credential changes, and require vendors to document secret storage, rotation and incident notification times in contracts.