When Cyberattacks Move at Machine Speed

Page 1

BUNCOSMOS | AI SAFETY LAB

AI SAFETY DEEP DIVE | FACT-CHECKED EDITION When Cyberattacks Move at Machine Speed

Storm-0940, ARTEX and the ConnectWise supply-chain compromise

22 October 2026 | Evidence: Microsoft, ConnectWise, Huntress, CrowdStrike and Reuters

A supply-chain compromise disclosed this month has become one of the clearest examples yet of agentic AI entering real offensive cyber operations. Microsoft says a China-state aligned actor it tracks as Storm-0940 used the autonomous penetration-testing framework ARTEX to accelerate attacks against hundreds of organizations and to support the compromise of ConnectWise Cloud Backup, a multi-tenant service used by managed service providers. The important story is not that an AI suddenly became a hacker on its own. It is that existing attack techniques were combined with software agents able to keep searching, testing and acting at machine speed.

The essential distinction

Microsoft says ARTEX attempted sign-ins to more than 2,250 Microsoft 365 tenants during the ConnectWise campaign. That does not mean 2,250 tenants were breached, and successful authentication does not by itself prove data theft. The strongest evidence supports a story about scale, speed, application- credential abuse and persistence, with the final scope of compromise still being investigated.

What happened

ConnectWise Cloud Backup, formerly SkyKick, is designed for managed service providers that protect Microsoft 365 data for many downstream customers. To perform backup and recovery, the service needs broad permissions to mailboxes, OneDrive, SharePoint, Teams and directory data. That makes its application identity unusually powerful. If a vendor-held application credential is stolen, an attacker can potentially authenticate as the trusted application rather than as an ordinary employee.

Huntress reported on October 16 that a credential belonging to the ConnectWise Cloud Backup application had been compromised and was being used to obtain Microsoft Graph tokens inside customer tenants. Huntress said it had confirmed unauthorized sign-ins in 162 tenants by 19:00 UTC that day. In an October 17 update, Huntress expanded its observations to almost 1,000 Entra tenants with sign-in activity from the associated IP address, with successful sign-ins in over 300. These figures describe authentication activity, not a confirmed count of data-theft victims. [3]

Huntress also documented a related ConnectWise application assigning itself the Global Administrator role and adding new client secrets to other applications. Its later investigation identified post-compromise activity in two tenants. Huntress cautioned that it had not tied the earlier privilege and credential changes to the same operator as the later public-IP authentication sweep. Microsoft separately attributes the broader campaign to Storm-0940. [1,3]

ConnectWise says it discovered the broader issue on October 14 and began incident response. It subsequently disabled affected application identities, suspended Cloud Backup and two integrated services, reset accounts and credentials, brought in independent specialists and began a controlled restoration. On October 22 it said phased restoration was underway, while individual Microsoft 365 tenants still required review for unauthorized changes or persistent access. The

Deep Dive | Reviewed 22 October 2026 1

Page 2

BUNCOSMOS | AI SAFETY LAB

company says existing backup archives remain encrypted, isolated and preserved, with no indication that those archives were compromised. ConnectWise says the original credential-exposure mechanism remains under investigation and that whether a product vulnerability contributed has not been established. [2]

A short timeline

DATE DEVELOPMENT

September Microsoft says Storm-0940 was already using ARTEX against hundreds of organizations across multiple sectors. [1]

10-14 Oct An earlier password-spray campaign targeted 327 accounts across eight organizations. Microsoft recorded 151,000+ failed logons, peaking at 2,900 failures per minute. It observed no successful authentication from that spray. [1]

14 Oct ConnectWise says it identified the issue and initiated investigation and response. [2]

15-16 Oct Application-credential abuse occurred on October 15. By 19:00 UTC on October 16, Huntress had confirmed unauthorized sign-ins in 162 tenants. [3]

17 Oct Affected services were suspended and relevant applications disabled. Huntress expanded its observed scope to almost 1,000 tenants with activity from the associated IP; sign-ins succeeded in over 300. [2,3]

21 Oct Microsoft publicly attributed the campaign to Storm-0940 and detailed ARTEX use. ConnectWise acknowledged the Microsoft assessment. [1,2]

22 Oct ConnectWise said phased restoration continued. It instructed partners to keep affected connections disabled until formal service-specific instructions applied and to review individual tenants. [2]

What ARTEX changes

ARTEX is an open-source penetration-testing framework built around multiple large-language-model agents. Microsoft describes agents that accumulate discovered assets and vulnerabilities into a graph and can work with different underlying AI models. In authorized security work, such tools can help explore an environment and coordinate repetitive tasks. The same architecture is dangerous when the objective is malicious. [1]

Microsoft says Storm-0940 used ARTEX to automate scanning and reconnaissance, password spraying and abuse of OAuth applications. During the ConnectWise supply-chain campaign, the framework was used to attempt sign-ins to more than 2,250 tenants at a reported rate of 2,900 sign-in attempts per minute. In several ARTEX- driven attacks observed by Microsoft, the period from selecting a target to obtaining privileged cloud access was less than three hours. [1]

The operational change Microsoft highlights is faster, coordinated execution. Password spraying, stolen application credentials and abuse of Microsoft Graph are not inventions of generative AI. Attackers have used automation for decades. Agentic systems change the tempo because they can combine many ordinary steps into a persistent workflow, keep operating outside human working hours, try multiple paths in parallel and carry information from one action into the next.

Deep Dive | Reviewed 22 October 2026 2

Page 3

BUNCOSMOS | AI SAFETY LAB

2,250+ 2,900/min < 3 hours

tenants targeted by sign-in attempts sign-in attempt rate reported by

targeting to privileged access in

Microsoft

multiple observed attacks

Why the supply chain mattered more than the model

The most consequential weakness in this incident was trust. A multi-tenant backup application had already been granted access across many customer environments. Once hostile actors controlled relevant application credentials, they could authenticate through a pathway that customers had intentionally authorized for backup and management. Microsoft emphasizes that this did not require an interactive user sign-in, and the activity did not result from a vulnerability in Microsoft corporate systems, products or services.

This is why the incident cannot be reduced to a story about a powerful model. The model and agent framework accelerated activity, but the leverage came from identities, permissions and a trusted software relationship. An automated workflow becomes far more dangerous when it is handed a credential that already opens doors.

In multiple customer environments, Microsoft observed follow-on activity through Microsoft Graph, including reconnaissance, changes to application credentials and attempts to modify identities, groups and privileged roles. Those changes matter because a newly added credential can survive removal of the original compromised connection and function as a backdoor. ConnectWise has therefore repeatedly told partners that restoration of the vendor service does not replace a separate review of each customer tenant.

What is confirmed, what is attributed, and what remains unknown

OBSERVED / VENDOR-REPORTED MICROSOFT ASSESSMENT NOT ESTABLISHED

That all 2,250+ targeted tenants were breached, that every successful sign-in led to theft, or that AI independently devised the campaign objective.

Microsoft assesses that China-state aligned Storm-0940 was responsible for the ConnectWise compromise and used ARTEX to accelerate the campaign. [1]

Application credentials were abused and unauthorized authentication occurred. Services were suspended. Huntress documented unauthorized sign-ins and credential changes. [2,3]

Microsoft recorded 151,000+ failed logons in the earlier spray, with a 2,900-per-minute peak, and no successful authentication from that spray. [1]

Storm-0940 has used ARTEX since at least September. Multiple observed attacks reached privileged access in under three hours. [1]

A final count of data-theft victims; the original credential-exposure mechanism; whether a ConnectWise product vulnerability contributed. [1,2]

Deep Dive | Reviewed 22 October 2026 3

Page 4

BUNCOSMOS | AI SAFETY LAB

The warning arrived before ConnectWise

ARTEX had already appeared in real attacks before Microsoft tied it to Storm-0940. On October 7, CrowdStrike described a separate campaign against South Korean financial organizations in which an unknown actor used ARTEX alongside large language models. CrowdStrike found attacker-controlled infrastructure containing ARTEX configuration files and Claude Code session histories, and reported data exfiltration from affected organizations. CrowdStrike did not attribute that campaign to Storm-0940, and the distinction should be preserved. [4]

The earlier case matters because it shows that ARTEX is not a one-off private tool available to a single intelligence service. Microsoft says it has observed threat actors in multiple regions using the framework. This suggests that restrictions imposed by a single model provider cannot, by themselves, eliminate misuse of a framework that supports alternative models. The surrounding controls become as important as the model: network egress, application permissions, credential scope, audit logs and rapid revocation.

What this changes about AI-agent security

The ConnectWise incident is a practical demonstration of an architectural security principle: the security boundary cannot live only inside the model. A prompt saying “stay within scope” is weaker than an external system that prevents out-of-scope actions. In cyber operations, that means deterministic controls around identity, network access, tool permissions and credentials, plus monitoring that the agent cannot silently modify.

The same lesson applies to legitimate corporate agents. A coding assistant, research agent or IT automation system may begin with a benign goal, yet still become risky if it receives broad credentials and can change the systems that monitor it. Agent capability and authorization therefore have to be evaluated separately. A system can be very good at completing tasks and still be unsafe if it is allowed to do too much while pursuing them.

For defenders, machine-speed attacks also change the economics of response. A human analyst who discovers suspicious activity after several hours may already be behind an automated system able to test many tenants and persistence paths in the same period. Detection and revocation increasingly need their own automation. The contest is no longer simply human attacker versus human defender. It is human- directed software systems operating on both sides.

The part that should not be sensationalized

There is a temptation to describe the campaign as an autonomous AI deciding to attack thousands of organizations. The evidence does not support that. Human operators supplied the malicious objective and infrastructure. ARTEX provided a way to delegate large portions of the workflow to multiple software agents. The significant development is therefore not independent machine intent, but scalable machine execution.

It is equally misleading to say that ARTEX breached 2,250 tenants. Microsoft says it attempted sign-ins to more than 2,250 tenants during the ConnectWise campaign and that most broader ARTEX targeting was unsuccessful. Huntress and Microsoft documented real unauthorized access in subsets of environments, but the final number of affected tenants and the amount of data accessed remain unresolved. Keeping those distinctions intact makes the story more serious, not less: defenders are confronting a technology that can amplify an attack even while remaining imperfect.

Deep Dive | Reviewed 22 October 2026 4

Page 5

BUNCOSMOS | AI SAFETY LAB

A new tempo for an old problem

Cybersecurity has always involved asymmetry. A defender must protect many systems; an attacker needs only one useful route. Agentic AI can intensify that imbalance by lowering the cost of persistence, parallelism and repeated experimentation. Storm-0940 did not need ARTEX to invent password spraying, OAuth abuse or cloud persistence. It used agentic software to perform familiar work faster and at a scale that can leave defenders little time to respond. The under-three-hour examples are Microsoft observations; they do not establish a measured before-and-after comparison with human-only attacks.

The lasting lesson from the ConnectWise compromise is therefore architectural. Trusted applications should receive only the permissions they truly need. Credentials should be short-lived and easy to revoke. Changes to application identities and privileged roles need independent monitoring. Agent systems should operate behind boundaries they cannot rewrite. And when a supplier with access to thousands of downstream environments is compromised, restoring the supplier is only the first step; every customer environment may need to prove that the attacker did not leave another door open.

Sources and verification

[1] Microsoft Security Research and Microsoft Threat Intelligence. "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise." 21 October 2026. Read source

[2] ConnectWise Trust Center. Cloud Backup incident advisories, 16-22 October 2026; latest reviewed update: 22 October, 13:00 UTC. Read source

[3] Huntress. "ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks." 16 October 2026, including updates dated 17 and 19 October. Read source

[4] CrowdStrike. "Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance." 7 October 2026. Read source

[5] Reuters. "Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says." 21 October 2026. Corroborating news coverage; technical findings above were checked against primary sources. Read source

Editorial note: Reviewed against the sources above on 22 October 2026. Observed authentication, persistence, vendor attribution and unconfirmed data theft are distinct findings. The architectural lessons are editorial analysis. The investigation is ongoing and figures may change.

Deep Dive | Reviewed 22 October 2026 5