Essential Insights
- China-linked Storm-0940 exploited ConnectWise Cloud Backup, using the ARTEX AI framework to automate attacks across hundreds of organizations.
- AI enabled attacks at “machine speed”—including password spraying, reconnaissance, and abuse of trusted OAuth applications—with attempts reaching 2,900 sign-ins per minute.
- Stolen app credentials opened paths into customer cloud environments, where attackers attempted reconnaissance, persistence, and privilege changes; some campaigns reached privileged access in under three hours.
- The campaign highlights supply-chain risks and AI-enabled scale: defenders must rapidly detect suspicious app access, credential changes, and automated attacks across vendors and MSPs.
AI Agents Accelerate a Supply-Chain Attack
Microsoft says China-linked hacking group Storm-0940 used ARTEX, an AI-powered testing tool, during a supply-chain attack involving ConnectWise Cloud Backup. The tool helped automate scanning, password attempts and efforts to misuse trusted cloud applications.
Between October 10 and 14, 2026, the group targeted 327 accounts across eight organizations. Microsoft recorded more than 151,000 failed sign-ins, but found no successful access during that password-spraying campaign. On October 15, however, attackers used stolen identities for ConnectWise cloud applications to try to enter customer environments.
The activity reached as many as 2,900 sign-in attempts per minute. In some environments, the agents also examined cloud systems and tried to change credentials or permissions. Such changes can leave a way back in, even after a company blocks the original compromised application.
Trusted Connections Raise the Stakes
A software supplier can connect to many customer systems. Therefore, attackers who compromise a trusted application may gain a path to multiple organizations. ConnectWise said it temporarily shut down services and began restoring them in stages.
AI agents can work continuously and test many routes at once. That speed may make attacks easier to scale, but it does not make every attempt successful. The incident’s failed sign-ins show that monitoring and access controls still matter. Companies can reduce risk by limiting app permissions, checking cloud activity and quickly removing credentials they no longer trust.
As more businesses adopt AI tools for routine work, the same technology may help people solve problems faster. However, this attack shows why organizations must also plan for criminals to use automation. Stronger safeguards can help preserve the benefits of connected services without asking customers to trust them blindly.
Stay Ahead with the Latest Tech Trends
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Explore past and present digital transformations on the Internet Archive.
CyberAttacks-V1
