Microsoft - Data Breach
Executive Summary
Chinese state-aligned hackers exploited a breach of ConnectWise's cloud services to target over 2,250 Microsoft 365 customer accounts, using an AI-powered penetration testing tool called ARTEX to automate attacks. The attackers leveraged stolen ConnectWise application credentials to gain access without needing user passwords, achieving privileged cloud access in some cases within three hours. The campaign targeted government agencies, defense contractors, financial institutions, and technolog...
What Happened
Between September and October 2026, Chinese state-aligned hackers known as Storm-0940 exploited a security breach at ConnectWise, a cloud IT management vendor, to access over 2,250 Microsoft 365 customer accounts. The attackers used stolen ConnectWise application credentials to bypass normal login requirements and deployed ARTEX, an open-source AI-powered penetration testing tool, to automate their attacks at speeds reaching 2,900 authentication attempts per minute. In some cases, the hackers achieved privileged cloud access within three hours of targeting an organization.
Who Is Affected
Organizations worldwide that used ConnectWise's Cloud Backup, SaaS Security, or Cloud Management services and granted those services permissions to their Microsoft 365 environments were affected. Targeted organizations included government agencies, defense contractors, financial institutions, manufacturers, and technology companies. Microsoft identified at least eight organizations subjected to 151,000 failed password-spray attempts and observed AI-accelerated reconnaissance activity through Microsoft Graph affecting thousands of tenants.
Why It Matters
This incident demonstrates how attackers can weaponize AI tools to dramatically accelerate cloud-based cyberattacks and exploit trusted third-party service providers to bypass traditional security controls. The breach highlights the risks organizations face when granting cloud application permissions to external vendors, as these credentials can provide access without requiring individual user passwords. The speed and scale of AI-assisted attacks represent an evolution in threat capability, with attackers moving from reconnaissance to privileged access in hours rather than days or weeks.
What You Should Do
If your organization uses ConnectWise cloud services with Microsoft 365 integration, immediately review and revoke unnecessary application permissions granted to ConnectWise in your Azure Active Directory settings. Enable multi-factor authentication for all accounts, monitor your Microsoft 365 audit logs for unusual sign-in attempts or Graph API activity between September and October 2026, and review privileged role assignments for unauthorized changes. Organizations should implement conditional access policies that restrict application access based on risk signals and regularly audit all third-party application permissions granted to cloud environments.
Summary generated from verified sources and reviewed before publication. How we summarize.
Sources