ConnectWise Breach: AI Agents Tried Stolen App Credentials Against 2,250 Microsoft 365 Tenants

The ConnectWise breach was carried out by Storm-0940, a China-state aligned group that stole credentials for ConnectWise’s Cloud Backup applications and used the open-source AI agent framework ARTEX to try them against more than 2,250 Microsoft 365 tenants at 2,900 sign-in attempts a minute, Microsoft said on October 21, 2026. ConnectWise has reset its own credentials, and both companies say any access the attackers planted inside a customer’s tenant is that customer’s to find and remove.

The ConnectWise Breach Began With Stolen Identities for a Trusted Backup App

ConnectWise Cloud Backup, formerly SkyKick, reaches into customers’ Microsoft 365 environments through multi-tenant applications those customers had already authorized. ConnectWise first published an advisory on October 16, 2026 about unauthorized access to application credentials tied to the service. Microsoft’s analysis explains why that mattered. Once Storm-0940 held the app identities, it could authenticate to customer tenants as the application itself. That path involves no interactive user sign-in, so it never meets the password and multi-factor prompts that protect people. Microsoft’s hunting queries name three of the affected apps: ConnectWise Cloud Backup, ConnectWise MS Teams and ConnectWise MS Graph.

Microsoft Says ARTEX Agents Ran the Attack at 2,900 Sign-Ins a Minute

ARTEX is an open-source penetration testing framework built as a team of LLM-driven agents, written in Go with a Next.js interface and able to work with any AI model, according to Microsoft. It can carry a test from reconnaissance through data exfiltration with little human input. Microsoft says Storm-0940 has used it since at least September 2026. Between October 10 and 14, one of the group’s IP addresses sprayed passwords at 327 accounts across eight organizations and logged more than 151,000 failed sign-ins. After the ConnectWise credentials were taken, the same tooling attempted sign-ins to more than 2,250 tenants at 2,900 attempts a minute, a pace Microsoft says leaves defenders “little time to detect and respond.” In several separate intrusions, the gap between first targeting and privileged cloud access was under three hours.

Inside Some Tenants the Agents Added Credentials and Changed Roles

Microsoft says that in some environments the agents went past sign-in and used Microsoft Graph to map directories, add or change application credentials, and alter identities, groups and privileged roles. Its list of observed techniques includes one ConnectWise management application assigning itself global admin. Microsoft also cautions that a successful authentication does not by itself show that data was read or removed. TechCrunch’s Zack Whittaker reported that the stolen credentials let the hackers log in to customers’ Microsoft-hosted environments and reach their emails and files. Microsoft states that the activity did not stem from a vulnerability in its own corporate systems.

ConnectWise’s Reset Does Not Remove Backdoors Planted in Customer Tenants

ConnectWise suspended Cloud Backup along with SaaS Security and Cloud Management, began mitigations on October 17 at 05:00 UTC, and reset every account and credential in the affected environment on October 19. It started a phased restoration on October 21 and expects the work to take several days. Its advisory says existing backup archives remain encrypted and isolated with no sign of compromise. The company was also direct about the limit of its own cleanup: its containment does not remove access an attacker may already have set up inside an individual customer’s tenant. Microsoft makes the same point from the other side, warning that application credentials added by the agents can stay active as a backdoor after the original app is fixed. ConnectWise’s October 21 update, citing Microsoft’s intelligence, attributed the attack to a China state-aligned group.

Microsoft’s Guidance Is to Preserve Evidence Before Deleting Anything

Microsoft tells affected customers to keep the ConnectWise connections disabled until the vendor issues restoration instructions, and to hold off on deleting the enterprise applications, since deleting them first destroys evidence. Administrators should search every tenant by application ID instead of display name, including tenants where the integration is no longer in use. Sign-in review should start no later than October 15, 2026 and reach back to October 1 where logs allow. The next step is the Entra audit log: new credentials on applications or service principals, new owners, consent grants and privileged role assignments. Confirmed unauthorized changes should be removed only after the records are saved.

Why This Matters for Engineering Leadership

Every third-party app an organization consents into Microsoft 365 is a standing credential held by the vendor, with whatever permissions were granted on the day someone clicked approve. The ConnectWise case shows what happens when that vendor is breached. The attacker inherits the app’s permissions, signs in without touching any user account, and can add new credentials that outlive the vendor’s own fix. ARTEX shortened the timeline, with Microsoft recording privileged access in under three hours in several cases. Microsoft’s advice to search by application ID, including for integrations nobody uses anymore, assumes a team can produce a list of every consented app, its ID and its scopes on demand. Engineering and IT leaders should be able to produce that list today, alert on any credential added to a service principal, and question whether a backup tool needs the write and admin scopes it holds. A vendor’s statement that it has rotated its credentials marks the start of a customer’s investigation. For a related case of stolen platform secrets this week, see our report on the Railway breach.

FAQ