AI-driven ConnectWise attack reaches Microsoft 365 customers

What Happened

Microsoft researchers attributed the recent supply-chain attack affecting ConnectWise customers’ Microsoft 365 environments to Storm-0940, a China-state aligned threat actor active since 2021. The campaign combined a compromised third-party service with an agentic artificial intelligence penetration-testing framework called ARTEX.

The activity began before the ConnectWise compromise became apparent. During a four-day period ending October 14, Storm-0940 targeted 327 Microsoft 365 and Exchange Online accounts across eight organizations. Microsoft observed more than 151,000 failed logon attempts during that campaign, with activity peaking at 2,900 failures per minute. The password-spraying effort was described as widespread but ultimately unsuccessful.

The group then targeted ConnectWise’s Cloud Backup service using AI agents and the same malicious infrastructure. Microsoft said the attackers used ARTEX to reach more than 2,250 tenants at a rate of 2,900 sign-in attempts per minute. ARTEX can use large language model-driven agents to automate offensive workflows, allowing the threat actor to accelerate scanning, password spraying, and other stages of an attack.

In some customer environments, the activity moved beyond authentication. Microsoft observed reconnaissance through Microsoft Graph and directory operations, modifications to application credentials that could establish persistence, and changes involving identities, groups, and privileged roles. The attackers also abused OAuth applications in downstream environments. Microsoft identified multiple customers with evidence of follow-on activity, illustrating how a third-party application with extensive privileges can provide access beyond its intended purpose.

The full impact remains unresolved. Microsoft did not disclose how many customers were compromised and cautioned that successful authentication does not necessarily show that attackers accessed or stole data. ConnectWise temporarily shut down services following the attacks. It later began restoring services in phases, advised customers to keep connections disabled, and said recovery was expected to take several days.

Why It Matters

This incident joins three risks that are often managed separately: supplier access, cloud identity permissions, and attacker automation. The compromised path involved a service trusted by customers, while the downstream activity focused on Microsoft 365 identities and applications. That combination can turn a supplier incident into a customer identity incident without requiring a direct breach of every organization.

The speed is also operationally important. Activity reaching 2,900 sign-in attempts per minute leaves defenders less time to distinguish background failures from an organized campaign. AI agents can repeat reconnaissance and authentication workflows quickly, but the decisive risk remains the access and privileges available to them.

For business leaders, the service shutdown and phased restoration show that containment can interrupt normal operations even before the full data impact is known. For security teams, the reported changes to application credentials, identities, groups, and privileged roles mean recovery cannot stop at resetting user passwords. Trust in applications and directory configuration must also be re-established.

What to Watch

The most important unresolved question is how many customer environments were actually compromised. Successful sign-ins alone do not establish data access, and no total for affected customers has been released. Further updates may clarify whether attackers accessed information, changed additional credentials, or maintained persistence in more environments.

Customers should also watch the phased ConnectWise restoration and follow its instructions on when connections can be safely re-enabled. Restoration of the service does not by itself confirm that every downstream Microsoft 365 tenant is clean.

Microsoft said threat actors from multiple regions are using ARTEX to increase the tempo of attacks. That means defenders may see the same framework or similar agentic methods outside this specific campaign. Any new reports should be assessed separately rather than automatically attributed to Storm-0940.

What Defenders Should Do

Immediate containment: Follow ConnectWise’s direction to keep affected connections disabled while the service is being restored. Avoid reconnecting solely because a service component is available again; first confirm that the connected Microsoft 365 environment has been reviewed.

Identity review: Examine authentication records for concentrated password-spraying activity, unusual successful sign-ins, and sequences that moved from authentication into Microsoft Graph or directory operations. The campaign’s volume means teams should look for patterns across accounts rather than treating each failed login as an isolated event.

Application review: Audit OAuth applications and application credentials associated with the affected integration. Investigate unexpected credential modifications, newly established persistence, or changes that expanded application access beyond its intended purpose. Remove unauthorized changes and replace credentials that were modified or exposed.

Directory review: Check identities, groups, and privileged roles for unapproved changes. Pay particular attention to activity that followed a successful authentication, because Microsoft observed attackers progressing into directory reconnaissance and modification in some environments.

Recovery validation: Coordinate service restoration with identity and application checks. Document what was disabled, what was changed, and what evidence supports reconnecting the integration. Where follow-on activity is found, broaden the investigation before restoring trust.

The Larger Lesson

AI did not create the underlying access path in this incident. It increased the speed and scale at which an attacker could use that path. The deeper problem was the combination of a trusted third-party application, extensive permissions, and downstream cloud identities.

Organizations should therefore treat supplier integrations as part of their identity perimeter, not merely as software dependencies. A provider’s service can be restored while unauthorized credentials or directory changes remain in a customer environment. Effective recovery requires both operational restoration and independent validation of downstream trust.

The durable lesson is that machine-speed attacks demand equally disciplined control over application privileges, identity changes, and reconnection decisions. Automation raises the tempo, but excessive trust determines the blast radius.