Microsoft says a China-state-aligned actor used the ARTEX AI hacking tool, an agentic penetration-testing framework, to automate attacks that reached more than 2,250 Microsoft 365 tenants. The actor, which Microsoft tracks as Storm-0940, used ARTEX to speed up a supply-chain compromise tied to ConnectWise Cloud Backup, the service formerly known as SkyKick. Microsoft published its attribution on its security blog on October 21, 2026. As far as we can see, it is the first public link between an AI attack framework and the ConnectWise breach.
What Microsoft says Storm-0940 did
Microsoft says Storm-0940 was using ARTEX as early as September 2026. The actor targeted hundreds of organizations around the world across a broad range of industries.
ARTEX is a system of large language model agents that run a penetration test from reconnaissance through data exfiltration with little human input, according to BleepingComputer's report. That automation matters because it lets a small team of operators work many targets at once.
Several of these attacks gave the actor privileged access to an organization's cloud infrastructure. In multiple cases, less than three hours passed between the first targeting and privileged access. That window leaves defenders very little time after the first alert.
One operation Microsoft describes ran from October 10 to 14 and targeted 327 accounts by abusing OAuth application identities. CryptoBriefing reports that Storm-0940 activity dates back to at least 2021, though that detail rests on a single outlet.
Microsoft is clear about one point. The activity did not result from a compromise of, or a vulnerability in, Microsoft's corporate systems, products or services. The company also says that finding an affected application or a successful authentication does not necessarily mean customer data was accessed or exfiltrated.
How the ConnectWise Cloud Backup breach reached Microsoft 365
The ConnectWise incident started with a stolen application credential, not a user password. Attackers hijacked the application's own identity inside Microsoft 365 and signed in without a password or a multi-factor prompt, according to The Hacker News.
The attackers also rode on permissions that customers had already approved. SpecterOps notes that the abused access included Directory.ReadWrite.All, a broad permission. The breach did not need a new hole. It needed only the access that customers had already handed to the app.
The timeline is tight. Malicious activity started at least on October 15 from a single IP address, BleepingComputer reported. ConnectWise disabled the seven ConnectWise application identities listed in its technical guidance at 07:00 UTC on October 17, 2026, as stated on its advisories page.
ConnectWise acquired SkyKick in September 2024, along with the BCDR provider Axcient. Cloud Backup is now suspended. Techzine reports that backups were not running and restores were unavailable for customers during the suspension, and that it is still unclear when services will resume. ConnectWise says it has no evidence that the backup archives have been accessed.
How many Microsoft 365 tenants were hit
The tenant counts vary by source, so the numbers in circulation need context. The table below lists the main figures and what each one measures.
| Source | Figure | What it measures |
|---|---|---|
| Microsoft, as quoted by CyberScoop | More than 2,250 tenants reached | Tenants reached by ARTEX-driven activity, at 2,900 sign-in attempts per minute |
| Huntress, as reported by iTnews | 162 confirmed tenants | Unauthorized sign-ins confirmed |
| Huntress, later analysis | Almost 1,000 tenants | Sign-in activity from the attacker's address, with about 300 sign-ins succeeding |
| The Hacker News | 173 tenants | Figure cited in some coverage |
No source has published a reconciliation of these figures. Reached, confirmed and active are different measures, and a reader should not treat them as interchangeable. The scope of the "hundreds of organizations" beyond Microsoft 365 has not been itemized either.
What to check in your Microsoft 365 tenant now
Microsoft's guidance focuses on service principal sign-ins. These identities often hold broad permissions, which makes them a quiet but valuable target. Administrators, and managed service providers responsible for several customers, can start with these steps, drawn from vendor and researcher guidance:
- Confirm whether your tenant has a ConnectWise or SkyKick application connection, and check Entra ID enterprise applications for the identities listed in ConnectWise's technical guidance.
- Disable affected ConnectWise or SkyKick apps without deleting them, so the records remain available for investigation.
- Audit Entra logs for credentials added since October 13. New credentials can keep access alive after an app is disabled.
- Review sign-ins for activity from 144.172.64.128, the address cited in the research guidance.
- Run Microsoft Defender XDR hunting queries for suspicious Microsoft Graph activity.
- Review changes already made inside the tenant. Disabling an app does not undo them, and previously issued tokens may stay usable until they expire.
A clean sign-in log does not prove a tenant is safe. Earlier tokens and changes can persist after the first fix.
Why the AI angle changes the attack math
The AI element is mostly about speed and volume. A human operator working through reconnaissance, credential abuse and privilege escalation needs days. Microsoft's reporting describes cases where the sequence finished in under three hours, which suggests the agents handled each step without waiting for a person.
USA 24 recently covered a different AI agent case, in which a hacker's agents breached more than 100 company websites for about $5,000. That operation targeted websites. This one targets identity and cloud permissions, which carry far more reach inside a company.
The defensive picture is also different. USA 24 has reported on Microsoft's new risk scores and kill switches for rogue AI agents. Controls aimed at rogue agents inside a company's own environment do not, by themselves, stop an outside actor from abusing an app identity a customer already approved.
The winners in this incident are the attackers, who needed only existing permissions. The losers are the managed service providers and their customers, who face possible cleanup work and, for now, no restore path for Cloud Backup.
What to watch next
Several questions remain open. Microsoft and ConnectWise both say the evidence is not conclusive on whether customer data was accessed or exfiltrated. Whether ConnectWise restores Cloud Backup, and when, is also unknown.
Some claims about ARTEX are unverified. CryptoBriefing reports that the framework was released in July 2026 for legitimate security testing and went closed-source in October after reported misuse, but that comes from one outlet. FourWeekMBA reports that CrowdStrike said on October 7 that an attacker targeting South Korean financial organizations used ARTEX, and that detail also needs independent confirmation.
In the coming weeks, watch for a reconciled tenant count, a restore timeline from ConnectWise, and any published indicators from Microsoft or Huntress. If Storm-0940 keeps pairing agents with identity abuse, defenders should expect more intrusions that move from first contact to privileged access in hours.
