China-Linked Hackers Exploit ConnectWise Breach to Target 2,250 Microsoft 365 Tenants Using AI Agents
A China-linked cyberespionage group has used artificial intelligence agents and compromised ConnectWise application credentials to target more than 2,250 Microsoft 365 tenants, according to new findings from Microsoft. The campaign demonstrates how attackers can combine trusted cloud integrations with AI-driven automation to accelerate intrusions and establish privileged access in enterprise environments.
Microsoft attributes the activity to Storm-0940, a threat actor active since at least 2021 and associated with Chinese state-aligned cyberespionage operations. The group used ARTEX, an open-source AI penetration testing framework, to automate reconnaissance, credential attacks, and attempts to manipulate cloud identities. In some cases, the attackers progressed from selecting a target to obtaining privileged access in less than three hours.
The campaign followed a security incident at ConnectWise, an IT management software provider whose cloud applications had been granted permissions inside customer Microsoft 365 environments. After gaining control of application credentials, the attackers could attempt to operate through identities that customers had already authorized, bypassing the need to compromise individual user accounts.
The findings reveal an increasingly important security challenge: trusted application identities can provide attackers with powerful access to cloud environments, while AI agents make it possible to investigate and exploit those permissions at unprecedented speed.
From Password Spraying to Compromised Application Credentials
Storm-0940 has historically relied on established intrusion techniques, including password spraying and the exploitation of internet-facing services. Its latest campaign retained those methods but incorporated ARTEX to coordinate offensive operations with greater speed and scale.
According to Microsoft, the group began using ARTEX as early as September 2026 to target organizations across multiple industries, including government, defense, banking, manufacturing, and technology. The framework is written in Go and uses AI agents to automate activities such as reconnaissance, vulnerability discovery, credential attacks, and data collection.
Between October 10 and 14, Microsoft observed more than 151,000 failed sign-in attempts against 327 accounts belonging to eight organizations. These attempts were associated with a password-spraying campaign designed to identify accounts protected by weak or reused credentials.
Microsoft reported that none of the observed attempts in this particular campaign resulted in successful authentication. This indicates that the activity was unsuccessful against those monitored accounts, although it does not establish that the broader operation failed.
The attackers subsequently shifted toward a more effective access method: compromised ConnectWise application identities.
Unlike ordinary user accounts, application identities allow software services to authenticate programmatically and interact with cloud resources. Organizations commonly authorize third-party applications to perform functions such as backups, monitoring, administration, and security management.
When these identities possess privileged permissions, compromising their credentials can give attackers access to sensitive operations without requiring an interactive user login.
That distinction became central to the ConnectWise campaign. Instead of relying exclusively on password guessing, Storm-0940 attempted to exploit permissions that customer organizations had already granted to trusted ConnectWise services.
AI Agents Accelerate Attacks Across Microsoft 365
Microsoft observed Storm-0940 using ARTEX to attempt authentication against more than 2,250 Microsoft 365 tenants. At peak activity, the framework generated approximately 2,900 authentication attempts per minute, demonstrating the scale achievable through automated cloud operations.
The attackers also used AI-assisted workflows to investigate Microsoft 365 environments through Microsoft Graph, an API that provides access to information and management functions across Microsoft cloud services.
Once access was established, the observed operations included reconnaissance, application credential changes, and attempts to modify privileges. These actions could allow attackers to identify valuable resources, expand their permissions, and establish alternative methods of accessing compromised environments.
Microsoft reported that most attempts failed, but the group succeeded in establishing persistent privileged access at numerous organizations. The company has not disclosed the number of confirmed compromised customers or whether sensitive information was stolen.
This distinction is essential when interpreting the campaign's scale. The figure of 2,250 represents targeted Microsoft 365 tenants, not 2,250 confirmed breaches. Similarly, successful authentication does not necessarily mean that attackers accessed or exfiltrated customer information.
Nevertheless, the confirmed persistence activity demonstrates that the campaign extended beyond automated scanning. In some environments, the attackers progressed far enough to establish access that could potentially survive the revocation of the originally compromised credentials.
The role of ARTEX is particularly significant because the framework did not require attackers to invent fundamentally new techniques. Instead, it accelerated existing methods, allowing reconnaissance, authentication attempts, and identity manipulation to be coordinated within compressed operational timelines.
For defenders, this creates a serious timing problem. Activities that previously required extended manual investigation may now occur within hours, leaving security teams less time to identify unusual behavior before attackers establish a durable foothold.
ConnectWise Breach Highlights the Risks of Third-Party Cloud Trust
The attack was connected to a security incident at ConnectWise that prompted the company to suspend several cloud services, including Cloud Backup, SaaS Security, and Cloud Management.
The company identified unauthorized access involving application identities used to connect its services with customer environments. These integrations had been granted permissions necessary to perform legitimate administrative and operational functions.
By compromising the credentials associated with those identities, attackers could attempt to access customer tenants through existing trust relationships.
This approach differs from traditional attacks against employee accounts. Rather than persuading a user to reveal a password or approve a fraudulent authentication request, the attackers could authenticate as a software application that had already been approved by the organization.
Such activity may be difficult to identify when security monitoring focuses primarily on interactive user sign-ins. Application identities often operate continuously, access resources automatically, and perform administrative tasks without direct human involvement.
The consequences can also persist after an affected integration is disabled. If attackers create additional credentials, modify privileged roles, or establish new access paths, removing the original application connection may not eliminate every unauthorized foothold.
ConnectWise CEO Manny Rivelo said the company had contained the affected application connections and was restoring services gradually. However, organizations whose environments were accessed still need to determine whether attackers made changes that could provide continued access.
The incident illustrates a broader software supply chain risk. A trusted technology provider may connect to hundreds or thousands of customer environments, creating a concentrated opportunity for attackers who compromise its credentials or infrastructure.
In this case, the potential impact was amplified by the use of AI automation, which enabled Storm-0940 to test access across a large number of Microsoft 365 tenants in a relatively short period.