China's AI Agent Hacked 2,250 Microsoft 365 Tenants in Hours; MFA Didn't Apply

China's state-aligned hackers have turned the MSP supply chain into a skeleton key — and they used commercially available AI to do it. Microsoft Threat Intelligence on Wednesday publicly attributed this campaign to Storm-0940, a China-state-aligned threat actor, and revealed that the group deployed an open-source agentic AI framework called ARTEX to automate attacks across more than 2,250 Microsoft 365 cloud environments in a campaign that moved from initial targeting to privileged cloud access in under three hours at multiple victim organizations.

The disclosure, published Wednesday on the Microsoft Security Blog, marks the first confirmed nation-state agentic AI intrusion integrating a commercially available agentic AI tool into an active supply-chain attack targeting managed service provider infrastructure. The attack bypassed multi-factor authentication entirely — not by breaking it, but by exploiting a backup application that had already been pre-authorized by every victim's organization before the campaign began.

If your organization uses ConnectWise Cloud Backup for Microsoft 365 — formerly branded as SkyKick — act immediately: the article's final section details the specific application IDs, IP addresses, and log-review steps Microsoft and Huntress security researchers are advising.

What Is ARTEX, and Why Does It Change the Math for Defenders

ARTEX is an open-source autonomous penetration-testing framework developed in China by Autumn-27 . The project won Baidu's Agent+ challenge before it was publicly released, and it represents the current state of the art in agentic security tooling.

The framework uses a dual-graph multi-agent architecture. A Planner agent maintains a shared task list across operational cycles, breaking complex attack objectives into sequences without creating race conditions when multiple workers are operating simultaneously. Worker agents then execute specific subtasks — reconnaissance, credential testing, privilege escalation — and can query each other's execution histories to avoid redundant discovery work, per dual-graph multi-agent architecture details. A global asset graph accumulates discovered targets, credentials, and vulnerabilities as the campaign progresses, giving the operator — or in this case, the threat actor — an evolving map of the attack surface without needing to monitor every step.

Written in Go with an embedded .js frontend and PostgreSQL data store, ARTEX operates against any OpenAI-compatible large language model backend and supports five natural languages : English, Korean, Mandarin, Spanish, and Japanese. The framework was first used in South Korean banks on October 7, 2026, when CrowdStrike attributed intrusions against South Korean financial institutions to a threat actor using ARTEX alongside Claude Code and DeepSeek. The framework's creator subsequently made it closed-source, but as the Cloud Security Alliance noted in its October 9 research note, forks and local copies persist — closing the source does not remove copies already in circulation.

What distinguishes agentic AI from an automated script is not just speed — it is the capacity to accumulate context, adapt to what each environment reveals, and pursue multiple breach paths simultaneously without the fatigue, scheduling constraints, or cognitive limits that govern a human operator, as agentic AI exceeds scripted automation in every relevant dimension. Storm-0940's ARTEX-driven campaign against ConnectWise downstream customers operated at 2,900 attempts per minute peak — a tempo that left defenders very little time to detect, triage, and remediate before persistent access was established. As Microsoft's blog stated directly: "the speed of the activity allows very little time for Defenders to respond to those alerts and remediate the actor's access in a coordinated fashion." Standard alert-driven security operations, designed around human triage timelines, were structurally outpaced.

Why ConnectWise Was the Ideal Target: The OAuth Trust Model

To understand why this attack succeeded at scale without triggering MFA, it helps to understand how backup services authorize themselves to do their job.

ConnectWise Cloud Backup — acquired by ConnectWise when it bought SkyKick in 2024 — is an application that MSPs protect Microsoft 365 data with: email in Exchange Online, files in SharePoint, conversations in Teams. To back up and restore that data, the application needs broad, persistent access to each organization's tenant. That access is granted once, at setup time, through an OAuth 2.0 application consent — an authorization standard that allows one service to act on behalf of another without requiring an interactive user login each time. The permissions granted included Directory.ReadWrite.All, one of the highest-privilege scopes in Microsoft's permission model, covering the full directory of users, groups, and roles.

Because the application authenticates using its own credential rather than a user's password, MFA does not apply. There is no user to challenge. The application presents its credential, Microsoft verifies it, and access is granted for every tenant that has consented to the application — which, for a widely-deployed MSP tool, can be hundreds or thousands of organizations.

When Storm-0940 obtained ConnectWise's application credential (Microsoft and ConnectWise have not publicly explained how it was initially stolen), ARTEX agents used it to access 2,250 downstream customer tenants by authenticating as the ConnectWise Cloud Backup application. Florian Roth, head of research at Nextron Systems, described the structural risk concisely in a post noted by security researchers: "One compromised OAuth application with elevated permissions could give attackers access to emails, files, and directory data across hundreds of Microsoft 365 tenants."

The Attack in Two Phases

Phase One: Password Spray (October 10–14)

Between October 10 and 14, 2026, Storm-0940 infrastructure at IP address 144.172.64[.]99 ran an automated cross-tenant password-spray campaign targeting 327 accounts across eight organizations, attempting to gain initial access to Microsoft 365 and Exchange Online environments. Microsoft telemetry captured more than 151,000 failed sign-in events over the period, with the campaign peaking on October 11 at 2,900 failures per minute and concentrating more than 111,000 failures into a single day. Forty-eight accounts received more than 1,000 failed attempts each. Despite the scale, no successful authentication was recorded in this phase, per Microsoft's published attribution .

Huntress separately observed password-spray attempts against four law-firm tenants on October 13 and 14 from the same infrastructure, also without success, per Huntress Security analysis .

Phase Two: Supply-Chain Pivot (October 15 onward)

On October 15 — immediately after the password-spray campaign wound down — the picture changed. Using the same network range, Storm-0940's ARTEX agents began authenticating to downstream Microsoft 365 tenants using the stolen ConnectWise application credential. Huntress confirmed that between 06:13 and 08:34 UTC on October 15, the attacker moved through tenants processed in sorted order , requesting Microsoft Graph tokens a few seconds apart — a pattern consistent with a scripted target list, not a human operator.

In 50 tenants lost directory roles to ConnectWise service principals that assigned themselves directory roles — mostly Exchange Administrator — without any legitimate administrative action. In at least one confirmed environment, the ConnectWise Cloud Management application for Microsoft Teams self-assigned the Global Administrator role and then backdoors valid through 2028 were planted: it added client secrets to two other enterprise applications — including Huntress's own security platform — creating credentials that would remain valid until 2028.

Huntress ultimately confirmed 300 tenants confirmed unauthorized access out of nearly 1,000 that showed activity from the attacker's IP addresses. Huntress also identified a second, more targeted wave of attempts against 16 national security sector tenants in policy, national security, trade, and critical mineral sectors; most of those attempts failed because the ConnectWise application had not been installed in those environments.

ConnectWise published an initial advisory on October 16 and ConnectWise suspended all affected services by 07:00 UTC on October 17, simultaneously disabling seven application identities and suspending Cloud Backup, SaaS Security, and Cloud Management services. As of the time this article was published, those services remain suspended.

MSP Trust Chains Are Now a Primary Attack Surface

The structural lesson from this campaign extends beyond ConnectWise and beyond Storm-0940.

Managed service providers occupy an architecturally privileged position in enterprise IT. Their tools — remote monitoring and management software, cloud backup applications, identity management platforms — require broad, application-level permissions to do their jobs. Those permissions are granted at deployment and remain in place silently, often for years, even when the underlying tool goes unused. A 2021 ransomware attack by the REvil group against MSP software vendor Kaseya and its downstream customers demonstrated the same structural vulnerability at scale: one compromised MSP tool became an entry point for roughly 1,000 organizations in hours.

What the Storm-0940 ARTEX campaign adds is a new economic variable. Before agentic AI, exploiting an MSP supply-chain credential still required a human-speed process of identifying targets, prioritizing tenants, executing reconnaissance, and establishing persistence one environment at a time. At 2,900 attempts per minute, Storm-0940's ARTEX agents could cycle through hundreds of tenants in the time it took a defender to open the first alert. The ratio of attacker effort to attacker reach has shifted fundamentally.

CrowdStrike's Adam Meyers made the point directly in the context of the South Korean bank attacks just weeks earlier, per CrowdStrike on agentic AI operations : "ARTEX shows how adversaries are operationalizing agentic AI to move faster and conduct multiple intrusions in a short period." The Five Eyes cybersecurity agencies, in a June 2026 advisory, warned that frontier AI models are "anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities" and that the timeline is "not years, it is months," per the Five Eyes AI offensive threat advisory. The Storm-0940 ConnectWise campaign is what that transition looks like in practice.

Storm-0940: China-State Actor Since 2021

Storm-0940 is a China-state-aligned threat actor that has been active since at least 2021, with Storm-0940 sectors and targeting history spanning organizations primarily in North America and Europe across aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and nonprofits. Microsoft does not assign the group a named alias outside of its Storm designation, and as of October 2026, no known industry aliases have been attributed by other tracking organizations.

The group's targeting patterns are consistent with large-scale intelligence-collection objectives — gathering strategic information from government-adjacent organizations — rather than with financially motivated cybercrime. Its pre-ARTEX modus operandi followed a documented pattern: password-spray or internet-facing application exploitation for initial access, followed by credential-dumping tools for lateral movement, OAuth application credential additions for persistence, and Microsoft Graph for data exfiltration.

Microsoft notes that ARTEX has now been identified in use by threat actors across multiple geographic regions — not only Storm-0940 — suggesting the South Korean bank campaign and the ConnectWise campaign are early examples of a broader adoption trend rather than isolated incidents.

What Defenders Should Do Right Now

Microsoft and Huntress both recommend a sequence of immediate and longer-term actions for organizations that use or have previously used ConnectWise Cloud Backup.

Immediate containment: Keep all ConnectWise application connections disabled until ConnectWise issues formal restoration guidance. Do not delete enterprise applications as an initial response — doing so destroys forensic evidence before investigators can determine what occurred in the environment. The four ConnectWise application IDs listed to for in Microsoft Entra:

ConnectWise Cloud Backup: 506e08f9-6e9a-4da4-942b-a099a03644ae

ConnectWise – MS Teams: 24205314-2b89-4e07-a2a4-579e898a5640

ConnectWise – MS Graph: 0de14c77-b9b0-4137-9360-34878a929827

SkyKick Partner Portal: c921256f-04a7-44e8-9b2a-69c33929ba19

Older tenants may list these under the SkyKick Cloud Manager name.

Log review: Review service principal sign-in logs beginning from at least October 15, extending back to October 1 where records allow. Look for IP addresses from attacker infrastructure: 144.172.64[.]60 , 144.172.64[.]99 , and 144.172.64[.]128 . User-agent strings to flag: Python-urllib/3.12 , python-requests/2.31.0 , python-requests/2.34.2 , curl/7.88.1 , and azure-toolkit/1.0 .

Directory audit: Review Microsoft Entra audit logs for any credential additions to service principals, new role assignments, self-granted administrator roles, and changes to users, groups, or Conditional Access policies. 2028-expiry credentials survive app revocation — backdoor credentials planted in this campaign were set to expire in 2028, meaning disabling the ConnectWise application connection does not automatically revoke credentials already added to other enterprise apps in the tenant.

Microsoft Defender XDR detections covering this campaign include Defender XDR campaign detection rules for unusual Microsoft Graph activity from compromised ConnectWise applications, application self-assignment of the Global Administrator role, graph API activity from known Microsoft threat intelligence IP addresses, and suspicious sign-ins from verified nation-state infrastructure.

Longer-term posture: Apply least-privilege principles to all multi-tenant application permissions and OAuth consent grants. Any application that does not need Directory.ReadWrite.All should not have it. Monitor for credential additions and anomalous application-only activity, particularly for applications with highly privileged scopes. As Microsoft noted, the presence of a ConnectWise application or even a successful sign-in does not by itself confirm that customer data was accessed or exfiltrated — each environment must be assessed individually.

Microsoft has also Security Dashboard for AI launched at ai.security.microsoft.com to help organizations understand what AI assets exist in their environment, recognize emerging risk patterns, and govern AI agents, applications, and platforms — a resource that has become more urgent in the context of campaigns like this one.

How Does AI Change the Speed of Cyberattacks?

Defenders who already use continuous monitoring tools and automated response playbooks will see the alert volume from an agentic AI attack as distinct from prior campaigns: a very large number of sign-in events within a very short window, spread across many tenants simultaneously. That pattern is what ARTEX-driven attacks look like in telemetry. The specific detection signatures Microsoft published for Microsoft Defender XDR and Microsoft Sentinel — cited in the remediation section above — are designed to surface exactly this pattern.

Organizations that have not yet adopted automated threat detection with sub-minute response capabilities should treat this campaign as an inflection point. Agentic AI-powered attacks do not pause between targets. A defender reviewing the morning's alerts at 9 a.m. may already be responding to persistence that was established at 3 a.m.

Frequently Asked Questions

What is ARTEX, and can any hacker use it?

ARTEX is an open-source agentic penetration-testing framework developed in China that uses large language models to run autonomous reconnaissance, credential testing, privilege escalation, and exfiltration workflows — essentially a full offensive security operation with minimal human oversight. The developer made it closed-source in October 2026 after its misuse was publicly documented, but forks and local copies exist. Any threat actor with access to an LLM API and a copy of the ARTEX codebase can deploy it against real targets — no special nation-state infrastructure is required.

Why couldn't MFA stop this attack?

Multi-factor authentication applies to sign-ins that involve a human user. The ConnectWise Cloud Backup application authenticates using its own application credential — an API secret — not a user's username and password. When an application connects to Microsoft 365 using pre-granted OAuth permissions, there is no user to challenge with a second factor. Stealing the application's credential gives an attacker everything needed to authenticate to every tenant that has consented to the application, without ever triggering an MFA prompt. This is why Microsoft's guidance emphasizes least-privilege application permissions rather than MFA as the primary defense against this class of attack.

How do I know if my Microsoft 365 environment was compromised in the ConnectWise breach?

your Microsoft Entra ID for the four application IDs listed in the remediation section of this article. Then review service principal sign-in logs from October 1 onward for activity from the three IP addresses in the 144.172.64.x range. Check your Entra audit logs for any application self-assignments to privileged directory roles (Global Administrator, Exchange Administrator) that were not authorized by your team. If you find evidence of the attacker's activity, preserve all logs before taking remediation steps — and follow ConnectWise trust center and advisories before re-enabling any suspended application connection.

Why should organizations that don't use ConnectWise care this?

Storm-0940's choice of an MSP backup tool as the attack vector was not accidental. Any multi-tenant application that holds broad OAuth permissions across hundreds of customer environments is a candidate target for this class of attack. MSP software vendors, identity providers, security monitoring tools, and productivity applications with delegated administration rights all represent the same structural risk: a single stolen credential becomes a key to every door. The agentic AI component means that exploitation at scale now takes hours rather than weeks.

This article covers an active security incident. Organizations should consult Microsoft's published indicators of compromise and follow ConnectWise's remediation guidance directly.