Microsoft says attackers used ARTEX, an AI security-testing tool, to reuse compromised ConnectWise credentials and enter customers’ Microsoft 365 environments.
Source: MicrosoftConnectWise discovered the problem October 14 and published October 16. Microsoft disclosed its AI assessment October 21.
Backup software already held permission to access customers’ cloud services.
HuntressMicrosoft reports ARTEX agents using compromised application credentials across customer environments.
MicrosoftHuntress found added credentials in other applications, extending access beyond the original connection.
HuntressBackups returned for reauthorized tenants. Customers still need to verify successful new snapshots.
ConnectWiseEditorial analogy: a contractor’s pass opens several offices. If an intruder takes that pass and makes extra keys inside, cancelling the original pass does not remove every way back in.
An analogy for the mechanism; not an additional claim about the incident.Huntress confirmed unauthorized sign-ins. In two reviewed environments, attackers added credentials to retain access. Huntress
By October 30, ConnectWise reported restored backups and restores for reauthorized tenants. Reporting and notifications were still being restored. ConnectWise
Microsoft attributes the campaign to China-aligned Storm-0940. The AI model is undisclosed.
Huntress says its evidence fits AI assistance but cannot independently confirm Microsoft’s ARTEX attribution.
Huntress corroborates the preceding password spray but says its linkage to this campaign is not independently verified.
Successful sign-ins do not prove stolen files. Huntress’s limited logs cannot rule out all data access.
ConnectWise has not established how the original credentials were exposed.
Editorial lesson: organizations delegate access to suppliers so useful work can happen automatically. Defending that trust means checking what each connection can do, watching for unexpected changes, and being ready to revoke access across connected systems.
Attackers directed ARTEX’s activity. Microsoft
ConnectWise says customers must reauthorize and verify successful new backups; reauthorization alone does not prove protection has resumed. ConnectWise
Editorial guidance for customer organizations and their service providers. These connections do not prove that a particular control was absent or would have prevented the incident.
Identity owners can review supplier permissions, restrict credential changes and remove access that no longer serves a business purpose.
An application may need substantial access. Permission review does not replace investigating what happened.
Responders can correlate application sign-ins, new credentials and permission changes, then coordinate containment with suppliers.
Incomplete logs can leave unanswered questions. Rotating one credential may leave other access intact.
Application owners can keep an inventory of service connections and test how to disconnect and restore them safely.
Disconnection can interrupt useful services; continuity plans and current vendor instructions matter.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkExplore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Read this case’s update history →
Reviewed Oct 31, 2026 · Editorial methodology · Structured data