Microsoft has linked a supply-chain compromise involving IT services provider ConnectWise to an AI-assisted cyberattack campaign targeting hundreds of organizations worldwide. The activity, attributed by Microsoft to the China-linked threat group Storm-0940, highlights how attackers can exploit trusted software connections and use artificial intelligence to scale their operations.

According to Microsoft’s findings, the attackers compromised application identities associated with ConnectWise Cloud Backup, formerly known as SkyKick, and used them to target customer environments. The incident prompted ConnectWise to suspend several cloud services while investigating the breach and working to restore operations safely.

How the ConnectWise Supply-Chain Attack Worked

The incident centered on unauthorized access to application identities associated with ConnectWise Cloud Backup. These identities enable software applications to authenticate and access resources in customer environments, including Microsoft 365 tenants where the applications have been granted permissions.

By abusing a compromised credential, attackers could potentially access multiple organizations through an existing trusted application connection. This made the incident a supply-chain security concern, as the risk extended beyond the service provider to its downstream customers.

Security researchers reported unauthorized sign-ins across at least 162 Microsoft 365 tenants as of October 16, 2026. However, suspicious authentication activity does not automatically mean that every affected tenant suffered data theft or a wider compromise.

AI Tool ARTEX Helped Automate Cyberattack Activities

Microsoft identified Storm-0940 as the threat group associated with the campaign and reported that the attackers used ARTEX, an AI-assisted penetration-testing framework, to support their operations.

The framework can coordinate AI agents to automate security-testing activities, including reconnaissance and password-spraying attempts. Password spraying involves trying a small number of commonly used passwords against multiple accounts, rather than repeatedly targeting a single account.

Such automation can help attackers carry out operations at greater scale and speed. Microsoft reported that some attacks progressed to privileged cloud access in less than three hours, illustrating how quickly compromised credentials and excessive application permissions can create security risks.

The use of an AI-assisted framework does not mean that artificial intelligence independently conducted every stage of the attack. Rather, AI can help coordinate and accelerate tasks that attackers might otherwise need to perform manually.

ConnectWise Suspends Cloud Services During Investigation

ConnectWise responded by disabling affected application connections and suspending Cloud Backup. It also suspended SaaS Security and Cloud Management because those services were integrated with the affected environment.

The company said it had reset accounts and credentials in the affected Cloud Backup environment and was preparing for a controlled, phased restoration following security validation.

ConnectWise also stated that existing backup archives remained encrypted and isolated, with no indication that the stored archives had been compromised. However, the status of backup archives does not establish whether individual customers’ live Microsoft 365 environments experienced unauthorized access.

The company urged partners to investigate their own Microsoft 365 tenants and those of their customers, review application sign-in and audit logs, and keep affected application connections disabled until formal re-enablement instructions are provided.

What the Attack Means for Organizations

The incident demonstrates the risks associated with third-party applications that have broad permissions across multiple customer environments. Even when an organization maintains its own security controls, a compromised service provider or application identity can create another route into its systems.

Organizations using cloud backup platforms, managed IT services or other third-party applications should regularly review application permissions, remove unnecessary access and monitor service-principal sign-ins for unusual activity. They should also investigate unexpected credential changes, new application secrets and unauthorized privilege escalations.

Security teams should pay particular attention to applications with administrative privileges or access to multiple customer tenants. Limiting permissions and maintaining detailed audit logs can help reduce the potential impact of a compromised application identity.

Microsoft’s findings also highlight how AI-assisted tools can increase the scale and speed of cyber operations. While such tools can support legitimate security testing, attackers can also use automation to accelerate reconnaissance and credential-based attacks.

The investigation underscores the importance of securing trusted application connections, monitoring third-party access and responding quickly when suspicious activity is detected. As organizations increasingly rely on interconnected cloud services, the security of those connections remains an essential part of protecting their wider digital environments.