Post cover image

October 31, 2026

An AI agent knocked on 2,250 Microsoft 365 tenants. A trusted backup app opened the door.

Microsoft says a China-aligned group used ARTEX, an open-source AI attack framework, to abuse ConnectWise’s cloud apps. The lesson is about…

By Ken Lin

4 min read

Microsoft says a China-aligned group used ARTEX, an open-source AI attack framework, to abuse ConnectWise's cloud apps. The lesson is about the apps you have already trusted.

On 21 October, Microsoft published one of the more unsettling threat reports I have read this year. A China-state-aligned group it tracks as Storm-0940 used an AI agent framework called ARTEX to go after hundreds of organisations. In some cases, Microsoft says, the attackers went from first targeting to privileged cloud access in under three hours.

The easy headline is "AI hackers are here". The more useful one is this: the AI hammered on the front door and mostly failed. What worked was a side door that customers had opened themselves, a trusted backup app.

What Microsoft says happened

Storm-0940 is not new. Microsoft has tracked it since 2021, and its habits are familiar: password spraying, exploiting internet-facing apps, then hiding in the cloud by adding credentials to existing OAuth apps.

What changed is the tooling. ARTEX is an open-source penetration-testing framework that can run on any AI model. It is a team of AI agents that works through a whole attack, from reconnaissance to data theft, with little human input, and maps what it finds as it goes. Microsoft says several threat groups use it, not just this one. Earlier in October, CrowdStrike linked an ARTEX instance to data theft from South Korean financial firms, and the developer then said the project would go closed source because of abuse.

Microsoft describes two phases.

The front door. Between 10 and 14 October, ARTEX ran a password spray against 327 accounts at eight organisations. Telemetry recorded more than 151,000 failed sign-ins, peaking at about 2,900 attempts a minute. Microsoft says it saw no successful sign-ins in that phase. Nearly all of the activity was accounts locking out.

The side door. Storm-0940 also got hold of identities belonging to ConnectWise's cloud apps, including ConnectWise Cloud Backup (formerly SkyKick). Microsoft does not say how that first breach happened. With those identities, the agents signed in to customer tenants as the app itself. Expel notes that this meant no MFA prompt. ARTEX attempted sign-ins to more than 2,250 tenants. In some, it went on to read the directory, add credentials to other apps, change privileged roles and bulk-read secrets from Azure Key Vaults. In one case a ConnectWise management app assigned itself Global Administrator.

None

Two points matter for fairness. Microsoft says this was not a flaw in its own products. And an affected tenant does not automatically mean data was taken. ConnectWise's CEO told Reuters it appears a China state-aligned group was responsible. Expel reports that ConnectWise disabled seven app identities on 17 October.

Why the side door worked

When you connect a backup tool to Microsoft 365, you grant it an app identity with broad permissions. It needs them. A backup app has to read mailboxes and files to back them up.

That identity is different from a person. It signs in with a secret or certificate, not a password and a phone. Conditional Access rules written for users often don't touch it. And because it is a vendor app, it usually sits in many tenants at once.

So an attacker who controls the vendor's app identity does not need to beat your MFA. They arrive as something you already approved. Then they do what Storm-0940 has always done: plant extra credentials on apps so they can come back even after the original app is cleaned up.

None

This is a supply-chain attack, and those are not new either. What ARTEX added was speed and patience. Agents don't sleep, they try several paths at once, and they can work through thousands of tenants while a human team is still reading the first alert.

The case for staying calm

I don't want to oversell this, so here is the honest counter-argument.

The AI did not invent anything. Password spraying, OAuth abuse and role escalation are old techniques. ARTEX ran them faster and at larger scale. Defences built for those techniques still apply.

The basics held. On the front door, 151,000 failed attempts produced, as far as Microsoft observed, zero successful sign-ins. Lockouts and strong authentication did their job.

Most targeting failed. Microsoft says so directly. The damage came from one trusted path, not from AI breaking everything it touched.

What would change my mind? Evidence that AI agents are finding new ways in, not just running old playbooks faster. Today's report doesn't show that. But "faster and at larger scale" is still a real problem when your response plan assumes a human attacker working office hours.

What I would check this week

Most of this is in Microsoft's own guidance. If you run Microsoft 365, or manage it for clients:

  1. Find the ConnectWise apps by application ID, not display name, in every tenant where they were ever authorised. Keep them disabled until ConnectWise publishes restoration steps. Disable, don't delete: deleting destroys evidence.
  2. Look for new secrets and certificates on any app added since mid-October that you did not create, and any app that holds Global Administrator.
  3. Preserve logs before you clean up, then review sign-ins and audit records back to 1 October where you have them, including service-principal sign-ins on their own.
  4. List every third-party app with high-privilege permissions. For each one, ask: who approved it, does it still need this much access, and who would notice if it started behaving differently?

That last question is where I think most organisations are weakest. In 25 years of training IT pros, I have seen far more time spent on user passwords and MFA than on app consent. That made sense when apps were few. It makes less sense now that your backup, security and management vendors all hold keys to your tenant, and an AI agent can try every one of them overnight.

How many third-party apps in your tenant could sign in as themselves tomorrow morning, and who on your team owns that list?

Ken Lin is a Microsoft Certified Trainer of 25 years and an MCT Regional Lead, based in Sydney.

Sources