ConnectWise Attack Used AI Against 2,250 Microsoft 365 Tenants

October 25, 2026

Microsoft says Storm-0940 used AI agents and stolen ConnectWise app credentials against 2,250 Microsoft 365 tenants. See what is confirmed and what to check.

Microsoft says a China-aligned group used AI agents and compromised ConnectWise application credentials to attempt sign-ins to more than 2,250 Microsoft 365 tenants. That number does not mean 2,250 organizations were breached. It describes the campaign's reach. Some downstream tenants did experience unauthorized access and privileged changes, while many attempts failed.

If your organization or managed customers used ConnectWise Cloud Backup, formerly SkyKick, treat the incident as an identity compromise—not simply an AI story. Keep affected application connections disabled until ConnectWise gives service-specific instructions, preserve evidence, review every current and former connection by application ID, and investigate service-principal activity from October 1 forward where logs permit.

Research cutoff: October 25, 2026, before ConnectWise's scheduled 14:00 UTC daily update.

What Is Confirmed

Storm-0940 used ARTEX to accelerate a real campaign

Microsoft's October 21 primary threat report attributes the campaign to Storm-0940, a China-state-aligned actor. Microsoft says the group has used ARTEX since at least September 2026 against hundreds of organizations across aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, think tanks, and nonprofits.

ARTEX is an open-source agentic penetration-testing framework. It can connect language models to a workflow that performs reconnaissance, scans targets, tests credentials, and takes follow-up actions with limited human interaction. Microsoft says Storm-0940 used it to accelerate three familiar attack activities:

The underlying techniques were not invented by AI. Password spraying, stolen application credentials, Microsoft Graph reconnaissance, credential changes, and privileged-role assignments are established cloud-attack methods. The important change was speed and scale: an agentic framework helped the attacker repeat and adapt those methods across many targets.

The password spray generated more than 151,000 failed logons

From October 10 through 14, Microsoft observed the attacker's infrastructure target 327 accounts at eight organizations. The campaign produced more than 151,000 failed logon events. At its October 11 peak, it reached about 2,900 failures per minute and more than 111,000 failures in one day.

Microsoft says nearly 98% of those events received lockout responses. More importantly, it observed no successful authentication, token issuance, Microsoft Graph call, or directory change from that password-spray path.

That negative result belongs in the headline analysis. A large attempt count is evidence of automation and pressure; it is not evidence that the spray itself compromised those accounts.

Compromised ConnectWise application identities opened a different path

The more consequential activity used application credentials associated with ConnectWise Cloud Backup. ConnectWise's current Trust Center advisory confirms unauthorized access to application credentials in that environment.

An application identity is not the same as a person's username and password. A Microsoft 365 enterprise application can authenticate as a service principal and use permissions granted to that application. If an attacker obtains its credential, the attacker may be able to act as the trusted app without an interactive user sign-in or a user's multifactor-authentication prompt.

Microsoft says Storm-0940 attempted sign-ins to more than 2,250 tenants using compromised ConnectWise application identities. Its telemetry saw more than 200 sign-ins in under four minutes using four application credentials. In affected tenants, observed activity included:

Huntress independently reported confirming unauthorized sign-ins in 162 tenants by October 16. That establishes real downstream access, but it still does not turn every one of Microsoft's 2,250 attempted tenants into a confirmed compromise.

Some ARTEX-driven attacks reached privileged access in under three hours

Microsoft says several Storm-0940 attacks using ARTEX achieved privileged cloud access less than three hours after initial targeting.

That is the clearest operational lesson from the AI component. A defender may have only a short interval between an initial signal and an attacker obtaining durable authority. Alert review, evidence preservation, application disablement, credential rotation, and tenant-wide hunting cannot depend on a slow manual sequence that begins hours later.

The lesson is consistent with Microsoft's separate warning that AI agents should be treated as potentially risky insiders. The model is not the security boundary. Identity, permissions, independent monitoring, and the ability to stop actions must remain outside it.

ConnectWise suspended services and reset credentials

ConnectWise says it disabled affected application connections, suspended Cloud Backup, and also suspended SaaS Security and Cloud Management because they were integrated with that environment. It engaged independent incident-response specialists, strengthened administrative-access protections, reset accounts, and replaced application credentials.

The company's October 24 update says restoration, testing, and security validation were continuing through the weekend. Subject to successful checks, ConnectWise targeted October 26 to begin phased partner onboarding, with access to restore data from existing backups expected first and full service re-enrollment later.

Until service-specific instructions arrive, ConnectWise continues to tell partners to keep affected application connections disabled.

Stored backup archives have a narrower reassuring finding

ConnectWise says existing backup archives remain encrypted, isolated, and preserved, with no indication that those archives were compromised. It also says it has no indication that products beyond Cloud Backup—and the precautionary suspensions of SaaS Security and Cloud Management—were affected.

That finding matters, but it is easy to overread. ConnectWise explicitly separates the stored archives from live Microsoft 365 environments. Saying the archives show no indication of compromise does not establish that every downstream tenant was unaffected.

What Is Still Unclear

Exactly how the ConnectWise credentials were obtained

The public sources reviewed do not establish the initial route used to obtain the application credentials. Microsoft attributes the subsequent activity and describes how those credentials were abused, while ConnectWise confirms unauthorized access to the credentials. Neither public account provides a complete, independently verified root-cause narrative.

Do not fill that gap with speculation about a Microsoft vulnerability, a model-provider breach, or a particular phishing or software flaw. Microsoft states that this activity did not result from a compromise of or vulnerability in Microsoft's systems, products, or services.

How many tenants suffered material data access or exfiltration

Three numbers answer different questions:

Number What it means What it does not mean
2,250+ tenants Microsoft observed attempted sign-ins using compromised application identities 2,250 confirmed breaches
162 tenants Huntress had confirmed unauthorized sign-ins by October 16 Complete global victim count
151,000+ failures Failed password-spray events against 327 accounts at eight organizations 151,000 compromised accounts

Microsoft warns that an affected application—or even a successful sign-in—does not by itself prove data access or exfiltration. Investigators must correlate authentication with Graph operations, audit records, role changes, credential additions, mailbox or file activity, and other tenant evidence.

Which model powered each ARTEX operation

Microsoft describes ARTEX as model-agnostic and says it can work with multiple language models. Public reporting has connected ARTEX to other campaigns and model tooling, but the reviewed evidence does not establish one model provider for every action in the ConnectWise campaign.

The defensible claim is that an agentic AI framework accelerated the campaign. It is not defensible to assign every action to a particular commercial model without direct evidence.

Whether the October 26 restoration target will hold

ConnectWise's October 24 update set a target, not a guarantee. Partner onboarding and backup-restoration access remained conditional on testing and security validation. Organizations should use the Trust Center as the live source of restoration instructions and should not reconnect simply because the calendar reaches October 26.

Are You Affected? Use the APP Test

A logo in an admin portal or the absence of a user login alert cannot settle your exposure. Use the APP test: Applications, Privilege, and Persistence.

A — Applications: inventory by ID, not display name

Microsoft recommends finding all four ConnectWise application IDs in every tenant where the affected applications are currently or were previously authorized. Record each local service-principal object ID.

Search by application ID rather than display name. Names can change, be duplicated, or disappear after an integration is removed. Include:

Do not delete enterprise applications as your first response. Microsoft advises preserving configuration and evidence before irreversible changes. Follow ConnectWise's current disablement and restoration instructions.

P — Privilege: reconstruct what the application actually did

Review successful and failed service-principal sign-ins separately. An unusual success deserves investigation, but the sign-in is only the start of the story.

Look for:

Microsoft recommends reviewing activity from at least October 15 and extending service-principal review to October 1 wherever records are available. Preserve Entra sign-in and audit logs, Microsoft Purview Audit records, SIEM data, and previously configured Graph telemetry. Do not delay urgent containment while waiting for every export to finish.

P — Persistence: find what could survive a credential reset

Rotating one stolen secret does not remove every possible foothold. Investigate whether the attacker created or changed:

On confirmed suspicious activity, revoke unnecessary permissions and rotate relevant credentials. Preserve the original evidence and document each change so the response remains reviewable.

Why AI Changed This Attack Without Replacing Conventional Security

The campaign is best understood as an acceleration event.

The attacker still needed reachable systems, credentials, identities, permissions, and APIs. ARTEX did not make those controls irrelevant. It made it easier to coordinate reconnaissance, retry paths, and act across many organizations quickly.

This is similar to Spain's earlier reported AI-agent personal-data breach: the novel part was not a magical AI-only vulnerability. The agent chained familiar weaknesses and actions faster than a human operator might.

That changes defensive priorities:

  1. Application identities need the same scrutiny as human identities. Multifactor authentication for employees does not protect a stolen app secret.
  2. Permissions must be minimal and task-specific. A backup integration should not retain authority it does not need.
  3. Machine-speed behavior needs machine-speed detection. Thousands of attempts or cross-tenant operations should not wait for a person to notice a daily report.
  4. Logs must survive the incident. Short retention can erase the evidence needed to distinguish an attempt from a breach.
  5. Supply-chain access expands the review boundary. MSPs must examine each customer tenant, not only their own control plane.

What This Means for OpenVeil Users

The ConnectWise incident is not evidence that hosted AI is always unsafe or that local AI is automatically safe. It is evidence that an autonomous system's authority matters as much as the model it uses.

OpenVeil is a hosted, privacy-focused AI workspace for adults. In normal chat, conversation history is stored in the browser rather than as a normal server-side chat-history record, and documented prompts, uploads, selected history, media, and outputs are not used for foundation-model training. You can read more about what browser-local chat history means and how private AI claims should be evaluated.

Those boundaries do not make OpenVeil fully offline, anonymous, or a zero-log service. Active requests still require processing by OpenVeil and necessary providers. OpenVeil does not patch ConnectWise, audit Microsoft 365, rotate credentials, monitor service principals, or protect an unrelated company's cloud environment.

The relevant fit is narrower: if your task is a sensitive conversation, explanation, draft, or analysis that does not require autonomous access to Microsoft 365, email, tenant administration, or external tools, a conversational workspace with less standing authority offers a smaller action surface than an agent connected to those systems. Use the least powerful workflow that can complete the task.

Frequently Asked Questions

Were 2,250 Microsoft 365 tenants hacked?

No. Microsoft says compromised ConnectWise application identities attempted sign-ins to more than 2,250 tenants. Some tenants had successful unauthorized access and privileged changes, but the public sources do not establish 2,250 confirmed breaches.

Did the password spray compromise accounts?

Not in the Microsoft telemetry described. Microsoft recorded more than 151,000 failed logon events against 327 accounts at eight organizations and says it saw no successful authentication, token issuance, Graph call, or directory change from that spray.

Was Microsoft itself breached?

Microsoft says the activity did not result from a compromise of or vulnerability in its systems, products, or services. The consequential downstream access used compromised ConnectWise application identities authorized in Microsoft 365 tenants.

Were ConnectWise backup archives stolen?

ConnectWise says existing backup archives remain encrypted, isolated, and preserved, with no indication of compromise. That archive finding does not prove every live Microsoft 365 environment was unaffected.

What should ConnectWise Cloud Backup partners do now?

Keep affected connections disabled until ConnectWise issues instructions for the relevant service. Inventory all affected application IDs across every current and former tenant connection, preserve evidence, review service-principal activity and privileged changes, and follow the current ConnectWise and Microsoft guidance.

Did AI autonomously conduct the whole attack?

Microsoft says Storm-0940 used ARTEX to accelerate scanning, password spraying, and OAuth application abuse. Public evidence does not establish that humans were absent from every decision or that one model independently executed the entire campaign.

Would using OpenVeil have prevented this incident?

No. OpenVeil is not a ConnectWise or Microsoft 365 security product. Its relevance is for narrower conversational work that does not require an autonomous agent to hold application credentials or broad cloud authority.

Bottom Line

The ConnectWise campaign is a concrete example of agentic AI compressing an attack timeline. Microsoft says Storm-0940 used ARTEX and compromised application identities to attempt access across more than 2,250 Microsoft 365 tenants. Some unauthorized access and privileged persistence were real; the majority of the password spray failed; and the public record does not support calling all 2,250 tenants breached.

Respond to the identity compromise, not the hype. Keep affected applications disabled until formal instructions apply. Inventory by application ID. Preserve logs. Separate sign-in attempts from successful authentication, and successful authentication from proven data access. Hunt for permissions and persistence that could survive a credential reset.

AI made the campaign faster. It did not change the basic security rule: a trusted application identity with excessive or poorly monitored authority can become a powerful path into many organizations.

Sources

When privacy, account control, uploads, and search matter, OpenVeil gives you a private AI workspace designed for that job.