ConnectWise Attack: Microsoft Says China-Aligned Hackers Used ARTEX AI to Race Into Cloud Networks

Microsoft’s attribution, China’s objection

Microsoft said on October 21 that Storm-0940, which it assesses as China-state aligned, was responsible for the ConnectWise supply-chain compromise. Its investigation linked the operation to ARTEX, an AI-driven penetration-testing framework, and described broader attacks against hundreds of organizations, including aerospace, defense, energy, government and semiconductor targets. ^[1]

That attribution is Microsoft’s assessment, not an independently adjudicated finding. Reuters reported that ConnectWise CEO Manny Rivelo said the evidence available to his company also pointed to a China-state-aligned group. China’s embassy in Washington responded that China opposes hacking and rejected accusations against it as smears made under the pretext of cybersecurity. ^[3]

What ARTEX changed

ARTEX can connect AI models to agents that automate security-testing workflows, from reconnaissance through potential data exfiltration. Microsoft says Storm-0940 used it to accelerate scanning, password spraying and abuse of OAuth applications. Most targeting failed, but some ARTEX-driven attacks reached privileged cloud access in under three hours. Microsoft counted attempted sign-ins against more than 2,250 tenants after the ConnectWise intrusion—not 2,250 confirmed compromises. ^[1]

The opening was a trusted software connection. Huntress found that a compromised ConnectWise credential was being used to authenticate as the backup application inside customer Microsoft 365 environments. Because backup software already needs extensive access to mail, files and directory information, an attacker using that identity can inherit a powerful set of permissions without first persuading an employee to sign in. ^[5]

A successful sign-in is not proof of stolen data

In two tenants it reviewed, Huntress saw an application assign itself Global Administrator privileges and add secrets to other applications to preserve access. However, the firm found no evidence of mailbox or file manipulation, or user or policy changes, in those two environments. It warned that some directory reads leave no audit trail. ^[5]

ConnectWise’s investigation guide separates attempted access, successful authentication, configuration changes and actual data access. These are different findings, not interchangeable breach counts. It also cautions that normal backup reads and incomplete logging can complicate attribution; enabling logs now cannot recreate events that were never recorded. A completed checklist is not a guarantee that a tenant was unaffected. ^[4]

Restoration is still a controlled process

ConnectWise first published its advisory on October 16. In its October 26 update, the company said restoration, testing and security validation continued, with phased partner onboarding still being prepared. Its planned sequence prioritizes access to existing backup restores, followed by service re-enrollment. The company explicitly warned that restoring infrastructure does not mean every partner capability is available. ^[2]

The company says existing backup archives remain encrypted, isolated and preserved, with no indication of compromise, and reports no indication that other ConnectWise offerings are affected. Those assurances do not establish whether an individual customer’s live Microsoft 365 environment was accessed. ConnectWise says affected connections should remain disabled until it provides instructions applicable to the relevant service. ^[2]

The cleanup must reach every customer tenant

The practical response is tenant-by-tenant investigation, including dormant SkyKick integrations. ConnectWise’s guide tells authorized administrators to preserve sign-in and audit evidence, verify local application settings, and inspect credentials, permissions, owners, privileged roles and suspicious mail activity. Disabling vendor connections does not remove attacker-added credentials elsewhere. Confirmed unauthorized changes require separate remediation by an appropriately authorized responder before normal operations can be trusted again. ^[4]