Threat IntelligenceEmerging Threats

Microsoft Exposes Chinese State Actor's AI-Driven Cloud Breach Tactics

Analyst 207||Source: InfoSecMag
Rows of computer servers and networking equipment in a brightly-lit data center with technicians in the foreground.

The group "attempted to sign-in to more than 2250 tenants at 2900 sign-in attempts per minute," Microsoft reported — a pace the company says left defenders "little time to detect and respond."

Storm-0940 and the ARTEX platform

Microsoft attributes the campaign to a China-aligned nation-state actor tracked as Storm-0940. According to Microsoft, Storm-0940 has been active since 2021 and its primary objective is data theft. The actor used an agentic AI penetration-testing framework named ARTEX to speed discovery and exploitation across a wide set of targets beginning in September 2026.

Microsoft describes ARTEX as a multi-agent large-language-model platform that can "use any AI model to automate a variety of offensive security workflows, including penetration test from reconnaissance through data exfiltration." During tests the agents accumulate discovered assets and vulnerabilities into a graph to drive follow-on actions. While the platform defaults to English, it can be switched to Korean, Mandarin, Spanish, or Japanese.

How the ConnectWise compromise unfolded

Microsoft says the actor obtained privileged access to a number of organizations’ cloud infrastructure by combining traditional techniques — such as password spraying and exploitation of internet-facing applications — with AI-driven, automated workflows. The company observed the group establishing persistence in cloud environments by adding credentials to existing OAuth applications.

After gaining unauthorized access to the ConnectWise multi-tenant application, the actor used ARTEX to accelerate scanning, reconnaissance, password spraying and OAuth application abuse against downstream customers. Microsoft reported multiple customer environments with evidence of follow-on activity, including reconnaissance, application credential modifications to establish persistence, and changes to identities, groups and privileged roles.

Microsoft noted that, "After acquiring control of the identities of multiple ConnectWise cloud applications, the AI agents operating on behalf of the threat actor continued to use the same IP range to authenticate to customer environments using the illicit access acquired through these stolen app credentials, effectively taking advantage of the already established trust by these apps within a tenant."

Impact on ConnectWise services and customers

ConnectWise first identified suspicious activity on October 15 and discovered unauthorized access to application identities within its Cloud Backup environment on October 17. That discovery prompted the firm to take several cloud services offline, including Cloud Backup (previously known as SkyKick), SaaS Security and Cloud Management. Those services remained offline on the firm's status page at the time of ConnectWise's October 22 advisory.

On October 22 ConnectWise said it had started a phased restoration of its Cloud Backup service and warned customers: "We expect restoration to take several days and will share service-specific availability and reconnection instructions as confirmed. Keep affected connections disabled until formal instructions apply to your service." The company added that existing backup archives "remain encrypted, isolated, and preserved, with no indication of compromise," and that it has "no evidence that other ConnectWise products and services are impacted by the incident."

ConnectWise also advised customers to review individual Microsoft 365 tenants for unauthorized changes or persistent access.

Scope of targets and previous ARTEX use

Microsoft said the campaign targeted hundreds of organizations across an extensive set of industries: aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits. The company assessed the activity began in September 2026.

Separately, CrowdStrike reported in October 2026 that a China-based threat actor used ARTEX to discover vulnerabilities and compromise specific services in South Korean financial organizations, a campaign that resulted in data exfiltration. Microsoft’s findings place ARTEX-enabled workflows at the center of multiple incident narratives in recent weeks.

What this means for MSPs, ConnectWise customers, and security teams

  • MSPs and managed-service customers: ConnectWise warned that software supply chain relationships can create broad downstream exposure and noted that "MSPs are in the middle of that chain. They are targets in their own right, and they are also a path into every client they serve."
  • ConnectWise customers relying on Cloud Backup: The firm has stated archives remain encrypted and preserved, and that restoration is underway; customers should follow the firm's reconnection instructions and keep affected connections disabled until formal guidance is provided.
  • Security operations teams: Microsoft’s telemetry indicates a pattern of rapid, AI-accelerated targeting combined with OAuth credential abuse and lateral access using established app trust. Teams are being urged to look for unauthorized application credential changes, persistent OAuth entries, and suspicious authentication from the same IP ranges that previously authenticated stolen app identities.

The incident illustrates a convergence of classic access techniques — password spraying and exploitation of internet-facing services — with agentic AI orchestration that can execute thousands of authentication attempts per minute and repurpose trusted application identities. As ConnectWise moves to restore Cloud Backup and Microsoft continues its telemetry-driven analysis, the concrete next steps for customers are clear: verify tenant configurations, check for illicit OAuth credentials, and follow vendor instructions for reconnection. The larger question the facts leave on the table is how supply-chain trust will be adjusted when an app identity itself becomes a vector for rapid, machine-speed compromise.

https://www.infosecurity-magazine.com/news/microsoft-chinese-ai-connectwise/

ChinaData TheftEmerging ThreatsMicrosoftNation-StateAI-Driven AttacksCloud BreachARTEXStorm-0940
Related Intelligence

Continue Reading

Technicians inspect rows of computer servers and networking equipment in a brightly-lit data center.

GitLab Patches Max-Severity Flaw Exploited in Code Execution Attacks

GitLab has patched a critical flaw that allowed hackers to execute malicious code on its servers, thanks to an integer overflow vulnerability in its Regular Expression Compiler that could be triggered by a specially crafted regular expression. This max-severity vulnerability, tracked as CVE-2026-110264, could be exploited by unauthenticated users, posing a huge risk to GitLab users.

Analyst 207
Server room with rows of computer equipment and a blurred workstation displaying encrypted data.

Railway Breach Exposes Customer Secrets, Fuels AI-Powered Threats

A security breach at Railway exposed sensitive customer secrets, with a cryptocurrency theft transaction detected at least two hours before the incident was officially disclosed. The breach allowed an unauthorized third party to potentially access encrypted environment variables, affecting a subset of users.

Analyst 207
Rows of computer servers and networking equipment in a brightly-lit server room with a single out-of-focus device in the…

Amazon Detects Early PHP2Shell Exploitation Attempt Before Disclosure

Amazon's Threat Intelligence team detected a sneaky attempt to exploit a critical PHP vulnerability on October 17, four days before the flaw was even publicly disclosed. This early warning sign came from Amazon's internal honeypot system, MadPot, which caught an IP address linked to a commercial anonymization network, hinting at a threat actor at play.

Analyst 207
Server room with rows of racks and cables, one with a highlighted vulnerable system.

Threat Actors Exploit PHP2Shell Vulnerabilities Before Public Disclosure

Threat actors made a move to exploit PHP2Shell vulnerabilities just four days before they were publicly disclosed, with a suspicious probe detected by Amazon's Threat Intelligence team on October 17, 2026, originating from an anonymized IP address in Australia. This early attempt suggests that malicious actors had somehow gotten wind of the vulnerability before its scheduled reveal.

Analyst 207