Microsoft published its analysis on October 21, 2026: a China-state-aligned actor it tracks as Storm-0940 was responsible for the ConnectWise supply chain compromise of a multi-tenant application, and used an AI penetration-testing framework called ARTEX to scale follow-on attacks.
What Microsoft reports
- ARTEX: an open-source, multi-agent penetration-testing framework (Go backend, Next.js front end) that can use any AI model and runs from reconnaissance through exfiltration while mapping discovered assets.
- Scale: ARTEX was used from as early as September 2026 against hundreds of organizations; the actor attempted sign-ins to more than 2,250 tenants.
- Speed: in several cases, less than three hours passed from initial targeting to privileged cloud access. Most targeting failed, but the actor achieved privileged persistence at many organizations.
- Password spray, Oct 10-14: 327 accounts across eight organizations, 151,000+ failed logons, no successful authentication observed in that campaign.
- Timeline: public reports of the ConnectWise compromise surfaced October 15; ConnectWise published an initial advisory October 16.
- Apps involved: ConnectWise Cloud Backup, ConnectWise – MS Teams and ConnectWise – MS Graph. One app was used to self-assign the Global Administrator role.
What admins should check
- Search Entra enterprise applications by application ID, not display name; the IDs are in Microsoft’s post.
- Keep affected ConnectWise connections disabled until ConnectWise issues restoration guidance.
- Do not delete the enterprise apps first; preserve configuration and evidence.
- Review sign-in and audit logs from at least October 15 (October 1 where retained) for added credentials, new service principals, role assignments and consent grants.
- Rotate credentials and revoke permissions on confirmed suspicious activity; apply least privilege to multi-tenant app consent.
Where to be skeptical
- “Under three hours” describes several cases, not the typical outcome. Most attempts were unsuccessful.
- 2,250 is attempted tenants, not compromised tenants. Headlines that blur this overstate impact.
- Microsoft’s post is a vendor attribution; independent confirmation of the actor and the AI role is limited so far.
- The AI framework mainly compresses attacker effort. The entry point was an over-trusted third-party app, a familiar weakness.
Takeaway
The durable lesson is about MSP and backup-tool trust: multi-tenant apps with broad Graph permissions are high-value targets, and attackers now iterate faster. Audit them like privileged accounts.
