Microsoft says a China-aligned group used an open-source agent framework in the ConnectWise attack

Microsoft links the ConnectWise compromise to Storm-0940 and says the group used ARTEX, an open-source AI agent framework, against 2,250+ Microsoft 365 tenants.

23 October 2026

Microsoft has attributed the recent compromise of ConnectWise's cloud services to Storm-0940, a group it describes as China-state aligned. Microsoft says the group used ARTEX, an open-source penetration-testing framework built on AI agents, to automate much of the operation. The company published its findings on 21 October in a Microsoft Security blog post.

What Microsoft says happened

Microsoft says Storm-0940 has been active since 2021 and began using ARTEX in September 2026 against hundreds of organisations worldwide. It says most of that targeting failed. It describes ARTEX as a multi-agent system written in Go that runs tests from reconnaissance through to data exfiltration and can use any AI model. Microsoft did not say which model the group used.

The activity Microsoft describes ran in two stages:

Password spraying, 10 to 14 October: more than 151,000 failed sign-ins against 327 accounts at eight organisations, peaking at 2,900 failures per minute. Microsoft saw no successful logins in this stage.
Abuse of ConnectWise application identities: the group used compromised ConnectWise app credentials to authenticate to customer tenants through permissions customers had already granted, with no interactive user sign-in. Microsoft says it attempted sign-ins against more than 2,250 Microsoft 365 tenants.

Microsoft says agents then carried out follow-on activity through Microsoft Graph, including reconnaissance, changes to application credentials and attempts to change privileges. In some cases the time from first targeting to privileged cloud access was under three hours. The Next Web reports that Microsoft said the incident did not stem from a vulnerability in its own systems.

How many organisations were affected

The scale is not settled. According to The Register, Microsoft has not said how many customers were compromised or whether data was taken. It also notes that a successful login does not necessarily mean data was accessed. The Next Web, citing security firm Huntress, reports more than 300 tenants with successful sign-in attempts. That figure comes from Huntress, not Microsoft.

The outlets also give different dates for ConnectWise's actions. The Next Web says ConnectWise disabled seven application identities on 17 October and began a staged restoration on 21 October. The Register says it turned off its Cloud Backup, SaaS Security and Cloud Management services on 19 October. According to The Register, chief executive Manny Rivelo said the affected connections had been contained. He also cautioned that shutting them down would not necessarily remove attackers who were already inside customer environments. The Next Web reports that ConnectWise had not publicly responded to Microsoft's attribution.

Why the agent detail matters

Microsoft frames ARTEX as a tool that lets attackers work around the clock and try several routes at once, which shortens the time between choosing a target and reaching it. The Next Web quotes Microsoft's researchers: "Agents are not constrained by factors affecting humans." Microsoft says attackers from other regions are also using the free tool.

The disclosure coincides with a CrowdStrike report, summarised by CXOtoday, on four other groups that ran offensive agent frameworks in real intrusions. CrowdStrike assesses that agentic AI is likely to make baseline offensive operations widely available.

What defenders are told to do

Microsoft advises customers to:

keep the affected ConnectWise connections disabled until ConnectWise gives restoration instructions
preserve sign-in and audit logs before deleting anything
review service-principal activity from at least 15 October, going back to 1 October where records exist
remove unauthorised credentials and grants, rotate secrets, and apply least privilege to multi-tenant app permissions