Agentic AI Attack Used ConnectWise Credentials to Target 2,250 Microsoft 365 Tenants

The security risk in the Storm-0940 campaign wasn’t just its pace. Stolen credentials tied to ConnectWise’s cloud backup application let the China-aligned group target Microsoft 365 tenants through applications that already had permission to authenticate. That route bypassed interactive user sign-ins and put the security of trusted service connections in focus.

Microsoft Threat Intelligence says the group used ARTEX, an open-source agentic AI framework, to target more than 2,250 tenants. In some cases, Storm-0940 gained privileged cloud access in under three hours. Microsoft said its own systems, products, and services weren’t compromised or vulnerable in the activity.

“This activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and allows them to scale their operations exponentially,” Microsoft said.

Automated access through existing app permissions

After the ConnectWise breach, ARTEX attempted sign-ins across the targeted tenants at a rate of 2,900 per minute, Microsoft reported. ConnectWise issued an initial advisory on October 16 about attempted unauthorized access involving its Cloud Backup product, then expanded its containment guidance.

The attackers authenticated using identities associated with multiple ConnectWise cloud applications. Since those apps already had access to Microsoft 365 environments, the activity didn’t require employees to sign in or approve each attempt.

In some environments, the agents progressed to Microsoft Graph and directory operations. Microsoft described reconnaissance, changes to application credentials that could preserve access, and edits to identities, groups, and privileged roles. Such changes, it warned, “can remain active as a backdoor” after the original application has been remediated.

Yih Khai Wong, senior research manager for security services at IDC Asia/Pacific, said the speed leaves little time for a manual response. “2,900 sign-in attempts per minute and gaining privileged cloud access in under three hours is not a timeline any human analyst queue can keep up with, no matter how well-staffed the SOC,” he said.

Wong recommends setting predefined thresholds that automatically disable credentials, revoke tokens, or isolate service principals, with analysts reviewing the actions afterward. As he put it, “relying on a human to click ‘approve’ will not cut it.” ConnectWise did not immediately respond to a request for comment.

Third-party apps need privileged access controls

Yash Kadakia, founder and CTO of Security Brigade, sees a mismatch between how companies protect employee accounts and how they handle application permissions. “Companies spend enormous amounts of time securing employee logins with MFA and conditional access, while third-party applications can hold equally powerful permissions and authenticate without any employee being involved,” he said. “We’ve spent years implementing zero trust for humans while continuing to implicitly trust machines.”

Kadakia says vendor integrations should receive only the permissions they need, with continuous monitoring, regular access reviews, and a tested revocation process. “An application you stopped using a year ago may still have permissions in your environment today,” he said.

Wong described responsibility as shared: ConnectWise must protect the credentials and infrastructure that allow its application to reach customer tenants, while customers need to track which parties have access, what they can do, and how long that access should last.

Open-source agents widen access to attack tooling

ARTEX is a Chinese open-source, multi-agent LLM system that can work with any AI model. Microsoft says its agents can carry out a penetration test from reconnaissance through data exfiltration with little human involvement. Public reporting in October linked ARTEX to breaches at Korean financial institutions, and Microsoft said actors in multiple regions are using it.

Storm-0940 has been active since 2021. Microsoft says ARTEX-driven targeting has reached organizations in aerospace and defense, energy, financial services, government, semiconductors, and technology. Most attempts failed, but the group established privileged cloud persistence at many organizations in a short time.

Wong said open-source tools are making capabilities once associated with well-resourced groups easier to access. Kadakia added that individual requests don’t reliably reveal whether a human or an AI agent initiated them: a legitimate API call made with stolen credentials can look the same either way. His advice is to focus on identity behavior, not the operator behind it.

Microsoft’s guidance for affected tenants

Microsoft advised customers to keep affected ConnectWise connections disabled until ConnectWise provides restoration instructions, and not to delete enterprise applications as an initial response. It recommends searching by the four affected application IDs rather than display names, preserving Entra, Purview, and SIEM records, and reviewing activity from at least October 15—or from October 1 where records permit.

Microsoft also cautioned that an affected application’s presence, or even a successful authentication, doesn’t by itself prove unauthorized data access or exfiltration. For cloud defenders, the practical priority is to understand what each connected identity can do and be ready to cut off its access at machine speed.