They Didn’t Pick the Lock. AI Helped Them Use the Key

Hackers got into Microsoft 365 business accounts this month using a key the backup software already held. That key was the login for ConnectWise Cloud Backup, a tool that small businesses and the IT firms that serve them use to protect their email and files. Microsoft says a China-aligned group used AI agents to move through those accounts, and in some cases reached privileged access in under three hours.

How They Got In

Investigators say the attackers never had to guess a user’s password or beat a login screen. They signed in as the backup app itself, using its credentials, and because no person was logging in, multi-factor authentication never came into play, according to the security firm Todyl. The app already held broad permissions that customers had granted, which could include reading and writing email, files and Teams chats. Huntress said the credential lived in the vendor’s own systems, so nothing a customer did could have produced it, and that the attackers also abused ConnectWise’s related Cloud Management apps.

ConnectWise says it discovered the problem on Oct. 14, published its first advisory on Oct. 16 and shut Cloud Backup down early on Oct. 17, saying it had found unauthorized access to application identities. It disabled seven of its application identities that day. The company says “existing backup archives remain encrypted, isolated, and preserved,” and that disabling the connections does not undo changes already made inside a customer’s account.

On who was behind it, ConnectWise said on Oct. 21 that, based on the evidence available to it and threat intelligence shared by Microsoft, “it appears that a China state-aligned group was responsible.”

What Microsoft Says About the AI

Microsoft said on Oct. 21 that it assesses a China-state-aligned group it tracks as Storm-0940 was responsible. The company says the group used ARTEX, an open-source AI penetration-testing framework, to speed up scanning, password guessing and the abuse of app permissions. ARTEX runs several AI agents that can carry out a test from start to finish with little human involvement, Microsoft said, and the agents can work around the clock, weekends and holidays included. Microsoft said the group has targeted hundreds of organizations worldwide since as early as September, in sectors that include aerospace and defense, energy, financial services, government and legal.

Microsoft put numbers on it. The group attempted sign-ins to more than 2,250 tenants, which are individual organizations’ Microsoft accounts. In a separate password-guessing campaign from Oct. 10 to 14, Microsoft counted more than 151,000 failed logons against 327 accounts at eight organizations, peaking at 2,900 failures a minute on Oct. 11. It said no successful sign-in was seen in that campaign.

On speed, Microsoft said there were multiple instances where the time from first targeting to privileged access was under three hours. It did not say how many instances, and it did not say how much faster that is than a human team would have been. Microsoft said the majority of the targeting was not successful, but that the group still achieved privileged cloud persistence at many organizations in a brief time. It also cautioned that a successful sign-in does not necessarily mean customer data was taken.

In some of the affected accounts, Microsoft said, the AI agents went past signing in. They listed directories, changed application credentials to keep their access, and made changes involving identities, groups and privileged roles. Microsoft warned that those credential changes can stay active as a backdoor even after the original app is fixed. Its detection notes also describe secrets being read at scale across multiple Azure Key Vaults, the cloud storage for passwords and encryption keys.

How Many Were Hit

Nobody has published a firm total. Huntress confirmed unauthorized sign-ins at 162 tenants as of Oct. 16. A day later it said it had found sign-in activity from the attacker’s address at almost 1,000 tenants, more than 300 of them successful. Where the ConnectWise app was not installed, the attempts failed. Those counts cover only the tenants Huntress can see, and a tenant is one organization’s account, so it is not the same as a count of customers. ConnectWise cannot supply a number, because by design Cloud Backup gives it no visibility into customers’ Microsoft 365 environments.

Huntress described what happened next in two tenants as fast, scripted and indiscriminate. In one, a ConnectWise app gave itself the Global Administrator role, the highest level of control in a Microsoft 365 account, and added new credentials to two other apps, one of them a security tool, all in about five minutes. The apps it picked looked random, and in one tenant they were among the least powerful while far stronger ones were left alone. Huntress saw no sign of mailbox or file changes, but said reading directory information leaves no record, so it cannot rule out data being read. Todyl, which analyzed nine intrusions, found only sign-ins.

Huntress also saw a narrower attempt on Oct. 15 aimed at 16 tenants in the policy, national security, trade and critical minerals sectors. It failed, because the ConnectWise app was not installed in most of them, and Huntress said the second sweep appeared to be manual.

Where the Accounts Differ

ConnectWise says it has “not identified confirmed downstream customer compromise,” while adding that this “is not assurance that no unauthorized activity occurred.” Huntress, by contrast, counts 162 tenants with confirmed unauthorized sign-ins, and Microsoft says it saw follow-on activity in multiple customer environments. ConnectWise also says it has no indication that its other products are affected, while Huntress said it cannot verify that the rest of ConnectWise’s apps are secure.

Microsoft’s post groups the Oct. 10 to 14 password-guessing campaign and the ConnectWise break-ins together as Storm-0940 activity. Huntress, reviewing sign-in logs at more than 10,000 tenants it can see, found app sign-ins from only one address. It said failed password-spray attempts from nearby addresses did not appear to be related to those sign-ins at the time. The AI role also rests on Microsoft’s analysis. Huntress’s post describes the activity as scripted and notes Microsoft’s attribution, and says it has published a separate analysis of its own data.

The Tool and Its Maker

ARTEX was posted publicly on GitHub this year. The Wall Street Journal identified its developer as a Chinese security engineer, Li Puhua, who says he built it for authorized security testing. On Oct. 8 he moved the project to closed source after it was linked to attacks on South Korean financial institutions. Microsoft says more than one group in several regions is now using ARTEX.

A separate report from Zscaler describes a Chinese-speaking operator who used ARTEX against targets in 19 countries between Aug. 4 and Oct. 4, and calls the activity likely financially motivated. China’s Foreign Ministry denied any knowledge of the ConnectWise attacks.

What Businesses Should Do

Microsoft’s advice to organizations that used the app is to keep the ConnectWise connections disabled until ConnectWise says otherwise, and not to delete the app first, because that can erase evidence. It says to preserve sign-in and audit logs, review activity from at least Oct. 15 (and back to Oct. 1 where records allow), and look for new credentials added to apps, new administrator roles and changed permissions. Unneeded permissions should be removed.

What Is Still Unknown

ConnectWise says the original credential-exposure mechanism remains under investigation, and that it has not established whether a product vulnerability played a part. On Oct. 27 it said it is ready to begin phased restoration but is waiting on a required third-party validation, and it still tells customers to keep the connections disabled. The total number of organizations actually breached is unknown, and Microsoft has not said how much faster the AI agents worked than human attackers would have. Microsoft said the activity did not come from a compromise of its own systems.

Sources:

•      Microsoft Security Blog, “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise” (Oct. 21, 2026)

•      ConnectWise Trust Center, “Cloud Backup (formerly known as SkyKick) Service Interruption” advisory (published Oct. 16, 2026, last updated Oct. 27, 2026)

•      Huntress, “ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks” (updated Oct. 27, 2026)

•      BleepingComputer, “Hackers breach Microsoft 365 tenants via ConnectWise supply chain attack” (Oct. 17, 2026, updated Oct. 18)

•      The Hacker News, “ConnectWise resets credentials as cloud services are restored in phases” (Oct. 20, 2026)

•      The Hacker News, “China-linked hackers use ARTEX AI” (Oct. 2026)

•      The Record, “China-aligned hackers, ConnectWise and ARTEX” (Oct. 2026)

•      Zscaler ThreatLabz, “Inside a global AI-assisted hacking campaign” (Oct. 2026)