The ConnectWise attack that Microsoft described this week is notable less for what the hackers broke than for how fast they moved. Microsoft says a China-aligned group called Storm-0940 used an AI penetration-testing tool to try its way into more than 2,250 Microsoft 365 tenants after first gaining control of apps tied to ConnectWise Cloud Backup. Most attempts failed. Some did not, and in some cases the group reached privileged cloud access in under three hours.
The findings come from a Microsoft Threat Intelligence post published October 21 and updated October 23. Microsoft calls its attribution an assessment, not a confirmed finding. It also says the activity did not result from a flaw in Microsoft’s own products.
How the ConnectWise attack worked
ConnectWise Cloud Backup is a multi-tenant application, meaning one vendor’s app is trusted inside many customers’ Microsoft 365 environments. Microsoft says the attackers took control of the identities of several ConnectWise cloud apps, including Cloud Backup, a Teams app, and a Graph app. Because customers had already granted those apps access, the attackers could sign in without any person approving a login.
That is the core of the problem. A person signing in can be prompted or locked out. An app that is already trusted skips that step. One ConnectWise management app also appears to have assigned itself the Global Administrator role, the highest level of control in a Microsoft 365 tenant, according to Microsoft.
ConnectWise published its first advisory on October 16 about attempted unauthorized access to its Cloud Backup product. Microsoft says that after that date, Storm-0940 used its tool to attempt sign-ins to more than 2,250 tenants. ConnectWise had not responded to a request for comment when CSO Online reported the story.
The role of AI agents
The ConnectWise attack relied on a tool called ARTEX. Microsoft describes it as an open-source penetration-testing framework that can run on any AI model. It is a multi-agent system, which means several AI programs share the work. Its agents can carry out a test from first scouting through data theft with little human input, and it builds a map of the assets and weaknesses it finds.
Penetration testing is normally a defensive job. Companies pay testers to break in so they can fix the holes. Microsoft says it has seen multiple regional threat actors using ARTEX, and that Storm-0940 has used it since early September against hundreds of organizations in many sectors.
The speed is what stands out. Microsoft says several attacks reached privileged cloud access in under three hours from first targeting. One graphic in its post notes more than 200 sign-ins in under four minutes using four application credentials. CSO Online lists the targeted sectors as aerospace and defense, energy, financial services, government, and semiconductors and technology.
The same pattern has shown up elsewhere. Our report on AI-assisted credential stuffing against South Korean banks covers a related use of automation, and our look at an AI-assisted Chrome exploit built in six days shows the same trend on the vulnerability side.
What we still do not know about the ConnectWise attack
The numbers need careful reading. Microsoft says more than 2,250 tenants were targeted and that “the majority of the targeting wasn’t successful.” It identified multiple customer environments with follow-on activity, but it does not give a count of how many tenants were compromised.
Microsoft is also careful about data. The post says an affected application or a successful sign-in does not necessarily mean customer data was accessed or taken. It does not confirm theft in this campaign, although it notes that Storm-0940 has a history of taking email through Microsoft Graph.
Where AI contributed is also an open question. Microsoft’s description supports the claim that the tool automated the probing and escalation. It does not show how much a human operator directed, and it does not say the attackers could not have done this without AI.
What administrators should do
After the ConnectWise attack, Microsoft’s guidance is detailed, and the first steps are plain. Keep the affected ConnectWise connections disabled until ConnectWise provides restoration instructions. Do not delete the enterprise apps first, because that removes evidence. Preserve sign-in and audit logs, but do not delay containment while waiting for exports.
Next, find the apps by application ID, not by display name. Microsoft’s post refers to four affected application IDs but its queries list only three, so check the full set against ConnectWise’s own advisory. Review activity from at least October 15, and back to October 1 where records exist.
The review should look at more than sign-ins. Microsoft tells administrators to check for new credentials on apps, new owners, consent grants, role assignments, and changes to users, groups, and Conditional Access policies. It warns that such changes can act as a backdoor even after the original application is fixed. Once evidence is saved, an authorized responder can remove anything unauthorized, revoke excess permissions, and rotate credentials.
Treat vendor apps as privileged accounts
The experts quoted by CSO Online pointed to the same lesson. Yash Kadakia of Security Brigade said third-party apps often hold powerful permissions with no human watching them, and recommended least privilege, monitoring, regular access reviews, and tested revocation. Yih Khai Wong of IDC said human analysts cannot keep up with a three-hour timeline, and argued for automatic containment, such as disabling credentials when preset thresholds are hit, with a human review afterward.
Organizations that buy backup and management tools through service providers may not know which apps they have approved. A good starting point after the ConnectWise attack is to list every third-party app in your Microsoft 365 tenant and ask who owns each one.
Editor’s take
The ConnectWise attack is a supply chain story first and an AI story second. The way in was a trusted vendor app, and defenders have known for years that such apps are a weak point. What AI changed, if Microsoft’s account holds, is the clock. When a tool can probe thousands of tenants and escalate in hours, the patient quarterly review of app permissions stops being enough. We would treat the unanswered questions, especially how many tenants were actually compromised, as the next thing to watch, and we would audit vendor apps this week.
