Chinese State-Sponsored Attackers Leverage Agentic AI to Breach ConnectWise and Global Organizations

In a chilling demonstration of how advanced technology is reshaping the threat landscape, a China-aligned nation-state actor has launched a sophisticated, AI-driven campaign that successfully compromised Microsoft 365 tenants associated with IT management software provider ConnectWise. The breach, which triggered a widespread suspension of several ConnectWise cloud services, highlights a harrowing new reality for the cybersecurity industry: attackers are now operating at "machine speed," utilizing agentic AI frameworks to bypass traditional defenses with unprecedented efficiency.

Microsoft, which has been closely tracking the adversary—identified as Storm-0940—revealed that the campaign began in September 2026. The group is leveraging a specialized agentic AI penetration testing framework known as ARTEX. By deploying this automated toolset, Storm-0940 has managed to target hundreds of organizations across a vast array of global sectors, ranging from aerospace, defense, and semiconductor manufacturing to financial services, government agencies, and major non-profit think tanks.

The speed of the operation is particularly alarming to security analysts. According to Microsoft’s assessment, the threat actor has repeatedly demonstrated the ability to obtain privileged, unauthorized access to an organization’s cloud infrastructure in less than three hours from the moment of initial targeting. This accelerated timeline leaves little room for human defenders to react, detect, or mitigate the intrusion before the adversary has established a foothold.

The Evolution of Storm-0940 and the Threat of AI Automation

Storm-0940 is not a newcomer to the global cyber-espionage arena. Active since at least 2021, the group has long been identified as a data-theft-focused operation. Historically, the collective relied on conventional tactics such as password spraying and the exploitation of internet-facing vulnerabilities to gain an initial entry point. Once inside, they typically cemented their persistence within cloud environments by injecting malicious credentials into existing OAuth applications, effectively masquerading as legitimate services.

The introduction of the ARTEX platform represents a significant leap in the group’s capabilities. ARTEX is a multi-agent large-language model (LLM) framework designed to automate the entire offensive security lifecycle. From initial reconnaissance and vulnerability scanning to sophisticated exploitation and data exfiltration, the platform allows an attacker to orchestrate complex campaigns with minimal human intervention.

Microsoft’s analysis suggests that the platform is highly adaptable, capable of supporting multiple languages—including Mandarin, Korean, Spanish, and Japanese—to facilitate operations across diverse geopolitical targets. By accumulating discovered assets and vulnerabilities into a centralized graph, the AI agents can map out an organization’s internal trust relationships with surgical precision. This allows attackers to identify the most critical pathways into a network, turning the very infrastructure of the target against itself.

Attackers Target the ConnectWise Supply Chain

The compromise of ConnectWise serves as a textbook example of why the software supply chain has become the "holy grail" for modern nation-state actors. By infiltrating a trusted IT management provider, attackers can gain an "all-access pass" to the environments of countless downstream customers.

After gaining unauthorized access to the ConnectWise multi-tenant application, Storm-0940 pivoted to target the firm’s clients. The scale of the attempt was immense; the group initiated sign-in requests to more than 2,250 tenants at a staggering rate of 2,900 attempts per minute. This high-velocity brute force attack, powered by the ARTEX framework, was designed to overwhelm standard security monitoring systems and bypass rate-limiting defenses.

Microsoft noted that in several identified customer environments, the follow-on activity was extensive. The attackers were observed conducting deep reconnaissance, modifying application credentials to ensure persistent access, and altering identities, groups, and privileged roles to deepen their control.

In a blog post dated October 21, Microsoft underscored the mechanics of this supply chain infiltration: "After acquiring control of the identities of multiple ConnectWise cloud applications, the AI agents operating on behalf of the threat actor continued to use the same IP range to authenticate to customer environments using the illicit access acquired through these stolen app credentials, effectively taking advantage of the already established trust by these apps within a tenant."

ConnectWise, acknowledging the gravity of the situation in its own advisory, echoed Microsoft’s concerns regarding the weaponization of AI. "Nation-state actors are increasingly targeting the software supply chain, because one trusted connection can open the door to many organizations," the company stated. "AI now lets them test those connections at what Microsoft calls ‘machine speed.’ Managed Service Providers (MSPs) are in the middle of that chain. They are targets in their own right, and they are also a path into every client they serve."

ConnectWise Responds to Cloud Service Disruptions

The discovery of this activity began on October 15, when ConnectWise’s internal security teams identified suspicious patterns within their network. Two days later, on October 17, the firm confirmed that unauthorized actors had indeed gained access to application identities within its Cloud Backup environment.

In an effort to contain the breach and protect its user base, ConnectWise took immediate and decisive action, taking several critical cloud services—including Cloud Backup (formerly known as SkyKick), SaaS Security, and Cloud Management—offline. These services remained inaccessible for several days while the company conducted a forensic investigation and worked to sanitize its environment.

The impact was felt by organizations worldwide that rely on ConnectWise for their infrastructure management and data protection. However, the company has emphasized that its backup archives remain isolated, encrypted, and preserved. According to ConnectWise, there is no evidence that the actual customer data within those backups was compromised or accessed. Furthermore, the company maintains that other products and services within the ConnectWise portfolio remain secure and unaffected.

As of October 22, ConnectWise has begun a phased restoration process for its Cloud Backup service. In its latest advisory, the firm cautioned customers that the restoration would take several days and provided instructions for reconnection. "Keep affected connections disabled until formal instructions apply to your service," the company advised, urging its users to conduct thorough audits of their individual Microsoft 365 tenants to look for signs of unauthorized changes, such as new, unexpected persistent access or altered roles.

A New Era of Cyber Conflict

The incident involving ConnectWise and Storm-0940 is part of a broader, emerging trend of Chinese-aligned groups utilizing AI frameworks to gain tactical advantages. Earlier in October 2026, cybersecurity firm CrowdStrike reported a similar campaign in which a China-based actor utilized the same ARTEX framework to discover vulnerabilities and compromise financial institutions in South Korea, ultimately resulting in significant data exfiltration.

The ability of these actors to automate the discovery and exploitation of trust relationships represents a fundamental shift in the threat landscape. Organizations that rely on third-party cloud management tools are now facing a heightened risk profile, where the security of their own environment is intrinsically linked to the integrity of their service providers. As Storm-0940 continues to evolve, the security community is left grappling with the challenge of how to defend against adversaries that no longer rely solely on human-paced manual labor, but rather on the relentless, high-speed execution of agentic AI.

For the time being, the industry is closely watching the phased restoration at ConnectWise, while simultaneously accelerating efforts to audit OAuth application permissions and strengthen multi-factor authentication policies to prevent the kind of credential abuse that enabled this far-reaching supply chain attack.