Key points
- Microsoft identified a Chinese state actor using AI to target ConnectWise tenants.
- The attacker attempted sign-ins to 2,250 tenants at 2,900 attempts per minute.
- ConnectWise took cloud services offline after Microsoft confirmed the compromise.
The short version
- A Chinese nation-state group used AI to target ConnectWise customer environments.
- The attack began in September 2026 and targeted hundreds of global organizations.
- Microsoft observed evidence of follow-on activity in multiple customer accounts.
The details
Microsoft reported on October 21 that a threat actor known as Storm-0940 compromised Microsoft 365 tenants used by ConnectWise. This breach forced the IT management provider to take several cloud services offline. The actor utilized the ARTEX agentic AI platform to accelerate scanning and reconnaissance efforts. According to Microsoft, the group obtained privileged access to cloud infrastructure in some cases within three hours of initial targeting. The campaign affected hundreds of organizations across industries including aerospace, finance, and government.
The context
Storm-0940 has been active since 2021 and primarily seeks data theft. The group typically gains initial access through password spraying and exploiting internet-facing applications. Once inside, they establish persistence by adding credentials to existing OAuth applications. In this specific incident, the actor abused stolen app credentials from ConnectWise to authenticate to downstream customer environments. This method leveraged the established trust relationships between the apps and the tenants, allowing the AI agents to move quickly through the supply chain.
What should you do?
- Check for unauthorized OAuth applications in your Microsoft 365 tenant.
- Review recent sign-in logs for unusual volume or geographic locations.
- Rotate credentials for any cloud applications that may have been exposed.
- Monitor for changes to privileged roles or identity groups in your environment.
For customers and users
If your organization uses ConnectWise services, you should verify the integrity of your cloud accounts immediately. Teams usually check for new applications or permissions that were not authorized by internal staff. Look for unexpected changes to group memberships or admin roles, as these are common signs of persistence mechanisms.
Be wary of follow-up communications claiming to be from support or security vendors, as attackers often send phishing emails shortly after a breach to harvest more credentials. Validate the sender address carefully and do not click links in unsolicited messages. Report any suspicious activity to your internal IT security team for further investigation and potential credential resets.
What to do and how to stay safe: ConnectWise
- Audit all OAuth applications connected to your Microsoft 365 tenant for unknown entries.
- Review sign-in logs for high-volume attempts or logins from unfamiliar IP ranges.
- Reset credentials for any accounts that had privileged access during the exposure window.
- Enable multi-factor authentication for all administrative accounts if it is not already enforced.
General security guidance from the DataSafe Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which threat actor was responsible for this breach?
Microsoft assessed that the Chinese nation-state actor tracked as Storm-0940 was responsible.
What tool did the attackers use to accelerate the breach?
The attackers used the ARTEX agentic AI penetration testing framework.
How many tenants were targeted in this campaign?
The group attempted to sign in to more than 2,250 tenants.
