Chinese Hackers Used AI to Breach ConnectWise and Spy on 2,250 Companies

Quick Facts

• Microsoft attributed a supply-chain attack on ConnectWise's cloud backup service to Storm-0940, a China state-aligned threat group.
• The hackers used ARTEX, an open-source AI penetration testing framework, to attempt sign-ins at more than 2,250 organizations at nearly 3,000 attempts per minute.
• ConnectWise disabled its Cloud Backup, SaaS Security, and Cloud Management services on October 17, 2026, as remediation efforts continued.

Chinese government-aligned hackers broke into IT management giant ConnectWise's cloud backup service and used an AI agent to target more than 2,250 organizations, according to reporting published October 22, 2026. Microsoft researchers attributed the attack to a group it tracks as Storm-0940.

The hackers stole application credentials from ConnectWise's cloud backup environment. Those credentials allowed them to authenticate to customers' Microsoft 365 environments as authorized users and access emails and files without triggering interactive sign-in alerts.

How the AI Tool Worked

Storm-0940 deployed ARTEX, an open-source AI agent framework designed to stress-test cyber defenses. The tool automated authentication attempts across thousands of targets simultaneously, running around the clock without human intervention.

Microsoft said the group attempted sign-ins at a rate of nearly 3,000 per minute. In several confirmed cases, Storm-0940 moved from initial targeting to privileged cloud access in under three hours.

'This activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and allows them to scale their operations exponentially,' Microsoft said in its security blog post. 'Agents are not constrained by factors affecting humans — they can work around the clock, on weekends, and on holidays.'

ARTEX's developer made the framework closed source on October 8 after researchers linked it to attacks on South Korean financial systems. Copies already downloaded remain in circulation.

The Attack Unfolded Over Days

Between October 10 and 14, Storm-0940 made more than 151,000 failed sign-in attempts against 327 accounts at eight organizations through password spraying. Those attempts produced no successful logins. The group then shifted to the stolen ConnectWise application identities.

On October 15, starting around 01:58 UTC, ConnectWise Cloud Management service principals began assigning themselves elevated Entra ID Directory roles inside victim tenants. Most assigned themselves Exchange Administrator access. Security firm Huntress found at least one case where Global Administrator was granted, along with modifications to two additional service principals for persistence.

Huntress recorded 162 confirmed compromised tenants as of 19:00 UTC on October 16. By October 17, that number reached 173. By October 19, Huntress was describing nearly 1,000 tenants with suspicious activity and more than 300 confirmed successes.

ConnectWise's Response

ConnectWise published an initial advisory on October 16 and disabled the seven application identities tied to the incident the following morning. By October 17, the company had shut off Cloud Backup access entirely. Over the following weekend, ConnectWise also disabled SaaS Security and Cloud Management as its investigation expanded.

ConnectWise CEO Manny Rivelo confirmed the company's findings in a public statement. 'It appears that a China state-affiliated group was responsible for the attack on ConnectWise Cloud Backup,' Rivelo said. He added that ConnectWise restricted connections to the affected application and began a gradual service restoration. The company engaged an external incident response firm.

ConnectWise said it had no indicators that backed-up partner data was taken, and that the existing cloud backup archive would be accessible once services resumed. The company's Trust Center advisories page has tracked ongoing disclosures and containment guidance.

Broader Warning From Microsoft

Microsoft Executive Vice President Igor Tsyganskiy said the ConnectWise attack is part of a larger pattern. 'Since early October, a wave of AI-driven cyberattacks has been ongoing,' Tsyganskiy wrote on LinkedIn on October 22. The ConnectWise supply-chain attack is 'one of many,' he added.

Microsoft's attribution to Storm-0940 connects this incident to prior ARTEX-driven attacks against South Korean financial institutions, many of which had weak security controls and no multi-factor authentication. Microsoft said the speed of AI-assisted attacks gives defenders little time to detect and respond before privileged access is established.

For Microsoft 365 administrators whose organizations use ConnectWise Cloud Backup, security teams should audit service principal permissions, review Entra ID role assignments made after October 14, and check for unauthorized client secrets added to existing app registrations.