AI agents did much of the work in the ConnectWise Microsoft 365 breach. Last week we wrote about the incident, where attackers used a stolen backup-service credential to sign in to customer tenants without needing a password or MFA. Now Microsoft has said who it believes was behind it, and how they moved so fast. The answer is the part every business should pay attention to.
What Microsoft Found
In an October 21 report, Microsoft attributed the ConnectWise supply-chain compromise to Storm-0940, a China-state aligned group active since 2021. The group has historically broken in through password spraying and vulnerable internet-facing applications, then hidden in cloud environments by adding its own credentials to existing OAuth apps.
What’s new is the automation. Since as early as September 2026, Microsoft says, Storm-0940 has used an open-source agentic AI penetration-testing framework called ARTEX to attack hundreds of organizations. In multiple cases, the time from first targeting a victim to gaining privileged cloud access was under three hours. After gaining control of ConnectWise’s cloud app identities, the group used ARTEX to attempt sign-ins to more than 2,250 Microsoft 365 tenants. Microsoft says the activity did not come from any compromise of, or vulnerability in, its own systems. AI agents allowed the group to scale and accelerate every stage of the operation.
The Password Spray That Came First
The campaign didn’t start with ConnectWise. Between October 10 and 14, an address later tied to the attack sprayed passwords at 327 accounts across eight organizations. Microsoft counted more than 151,000 failed sign-ins, peaking on October 11 at 2,900 failures per minute. It didn’t work. Account lockouts absorbed nearly all of it, and Microsoft observed no successful sign-in. The next day, the same infrastructure turned up using ConnectWise’s app identities instead.
That sequence is the lesson in miniature. Basic controls held against the front door, so the attacker went through a trusted vendor’s side door, where MFA and lockouts don’t apply.
What Is ARTEX?
ARTEX is an open-source system of AI agents that can use any AI model to run a penetration test from reconnaissance through data theft with little human involvement. Microsoft says actors in multiple regions are using it, and public reporting this month tied it to data breaches at Korean financial institutions. As Microsoft put it, agents “can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously.”
In some tenants, the AI agents went beyond signing in. They ran reconnaissance through Microsoft Graph, changed application credentials to keep access, and made changes to identities, groups, and privileged roles. Microsoft warns those changes “can remain active as a backdoor” even after the original app is cleaned up. It also cautions that an affected app, or even a successful sign-in, doesn’t automatically mean data was taken.
Why AI Agents Matter for Your Organization
This is the shift we described in September when we wrote about AI-speed attacks: what used to take a skilled team days now takes software hours. Yih Khai Wong of IDC told CSO Online that the operational sophistication once reserved for well-resourced groups “is now available to anyone who can run a GitHub repo against an LLM API.” Microsoft’s list of targeted sectors includes legal, manufacturing, media, and non-profits, not just defense and government.
It also exposes a blind spot. “We’ve spent years implementing zero trust for humans while continuing to implicitly trust machines,” said Yash Kadakia of Security Brigade, adding that “an application you stopped using a year ago may still have permissions in your environment today.” His advice: “Defenders should focus on what the identity is doing, not whether a human or AI is controlling it.”
Wong argues that containment steps, like disabling credentials, revoking tokens, and isolating compromised apps, should trigger automatically when predefined thresholds are hit, with people reviewing them afterward. Against machine-speed attacks driven by AI agents, he said, “relying on a human to click ‘approve’ will not cut it.”
What to Do This Week
If you worked through our earlier ConnectWise checklist, Microsoft’s guidance adds a few important steps:
- Keep affected ConnectWise app connections disabled until ConnectWise issues formal restoration instructions, and don’t delete them as a first step.
- Search your tenant by application ID, not display name, and check tenants where the apps were ever installed, even if you no longer use them.
- Preserve your Entra, Microsoft Purview, and security log records before cleaning anything up.
- Review activity from at least October 15, and back to October 1 where your logs allow. Look at failed and successful app sign-ins, and don’t limit the search to the published IP addresses.
- Check for new app credentials, new apps or owners, consent grants, privileged role assignments, and changes to users, groups, sign-in methods, Conditional Access, and mailbox rules.
- Treat every vendor integration like a privileged account: minimum permissions, regular reviews, and a tested way to cut it off.
The Takeaway
AI hasn’t invented new ways to break in. It has made the old ones dramatically faster and cheaper through AI agents. When an attacker can go from target to privileged access in under three hours, a security program that reviews alerts tomorrow morning is already behind. You need visibility into what your identities and apps are doing, and a plan to act at the same speed.
Want to know whether your business could keep up with a machine-speed attack? Schedule a free assessment with Black Belt Secure today.
Source: Microsoft Security Blog (Oct 21); CSO Online (Oct 22).