TL;DR: Microsoft assesses that Storm-0940, a China state-aligned group, was responsible for the attack on ConnectWise Cloud Backup (formerly SkyKick), and says the group used ARTEX, an open-source penetration testing framework built from AI agents, to automate its work. Microsoft says that, with stolen credentials for ConnectWise’s own cloud apps, the group used ARTEX to attempt sign-ins to more than 2,250 tenants at 2,900 sign-in attempts per minute, and that in some environments its agents went on to change app credentials and make changes involving identities, groups and privileged roles. Microsoft says that in multiple cases the group’s ARTEX attacks went from initial targeting to privileged cloud access in less than three hours. If you or your IT provider ever connected ConnectWise Cloud Backup or SkyKick to Microsoft 365, keep those connections disabled and review the tenant now, starting with app credentials and role changes since October 15.

What happened

Microsoft Threat Intelligence and Microsoft Security Research published their findings on October 21, 2026 (the post appeared at 18:23 UTC, 2:23 a.m. Manila on October 22). Microsoft says:

  • Who: Storm-0940 is a China state-aligned actor, active since 2021, that steals data from organizations in many industries. Microsoft “assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application.”
  • The tool: ARTEX is “an open-source penetration testing framework that can use any AI model,” a multi-agent system that runs an attack “from reconnaissance through data exfiltration with little needed human interaction.” Since at least September 2026, Storm-0940 has used it against “hundreds of organizations globally,” and Microsoft says threat actors in several regions now use the same framework.
  • The ConnectWise part: Microsoft says that after acquiring control of the identities of multiple ConnectWise cloud apps, the group “used ARTEX to attempt to sign-in to more than 2,250 tenants at 2,900 sign-in attempts per minute.” Because those apps “had already been granted access,” Microsoft says, the group could operate “without requiring an interactive user sign-in.” Microsoft says it found evidence of follow-on activity through Microsoft Graph in “multiple customer environments”: reconnaissance, app credential changes for persistence, and changes involving identities, groups and privileged roles. One of Microsoft’s Defender detections covers an application that “assigned itself to a high privilege role”; the alert is titled “Application self-assigned Global Administrator role.”
  • Before the breach: between October 10 and 14, the same infrastructure ran a password-spray campaign against 327 accounts at eight organizations, with more than 151,000 failed logons and no successful sign-in, Microsoft says.
  • What it doesn’t mean: Microsoft says the activity “did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services,” and that an affected app, or even a successful sign-in, “does not necessarily indicate that customer data was accessed or exfiltrated.”

In its own Trust Center update at 22:00 UTC on October 21 (6:00 a.m. Manila on October 22), ConnectWise says that, based on the evidence available to it, including threat intelligence shared by Microsoft, “it appears that a China state-aligned group was responsible for the attack,” and that the group “used an openly available agentic AI framework to automate and speed up its operation.” It says it has contained the affected application connections and is restoring services in controlled phases, but that those actions do “not remove unauthorized access that may already have been established within individual customer tenants, which require separate review.” In its latest update, at 00:45 UTC on October 22 (8:45 a.m. Manila), ConnectWise says “Phased restoration is underway,” that it expects restoration “to take several days,” and that partners should “Keep affected connections disabled until formal instructions apply to your service.”

Why it matters

Microsoft’s report describes a state-backed group using an AI agent framework at scale against ordinary businesses’ Microsoft 365 tenants. The techniques themselves are familiar: password spraying, stolen app credentials, quietly added backdoor credentials. What changed is the speed. Microsoft says the alerts this activity sets off arrive too fast for defenders “to respond to those alerts and remediate the actor’s access in a coordinated fashion.” For small businesses, the weak point was a trusted backup vendor’s app, not their own passwords, and Microsoft warns that app credentials an attacker added “can remain active as a backdoor” even after the vendor’s own app is fixed.

What to do now

Microsoft’s list is long; these are the steps that matter most for a small business or the IT provider that runs its Microsoft 365. Our ConnectWise Cloud Backup explainer has the background and ConnectWise’s own guidance.

  1. Keep the ConnectWise app connections disabled until ConnectWise issues formal restoration instructions, and don’t delete the enterprise apps as your first move: preserve configuration and logs first.
  2. Find the apps by ID, not by name, in every tenant where they are or ever were installed. Microsoft lists four: ConnectWise Cloud Backup 506e08f9-6e9a-4da4-942b-a099a03644ae, ConnectWise - MS Teams 24205314-2b89-4e07-a2a4-579e898a5640, ConnectWise - MS Graph 0de14c77-b9b0-4137-9360-34878a929827 and SkyKick Partner Portal c921256f-04a7-44e8-9b2a-69c33929ba19.
  3. Review from October 15 at the latest (October 1 if you have the logs): service principal sign-ins, successful and failed, and Microsoft Entra audit records for new app or service principal credentials, new apps or owners, consent grants and privileged role assignments, including any app that assigned itself a high-privilege role such as Global Administrator.
  4. Check mail and files for unusual access, downloads, forwarding and inbox rules from unfamiliar IPs. Microsoft lists 144.172.64.60, 144.172.64.99 and 144.172.64.128 as IPs seen signing in and calling Graph in ConnectWise customer environments, but says not to limit your review to them.
  5. If you find something, preserve the evidence, then have an authorized admin remove the unauthorized credentials, grants and role assignments and rotate the affected credentials.

Sources & method

Sources

Method. Last checked October 22, 2026, at 9:26 a.m. Manila time (01:26 UTC on October 22). The post time comes from Microsoft Security blog’s RSS feed. Microsoft revised the post on October 22 without an editor’s note (the page lists a modified time of 00:54 UTC, 8:54 a.m. Manila); this story reflects the current version, which describes attempted sign-ins to more than 2,250 tenants. All numbers, app IDs and IPs are Microsoft’s; the step order is our own condensed version of Microsoft’s list. No affiliate links on this page. How we work.

Spotted an error? See our corrections policy and tell us.