Microsoft’s ConnectWise account separates thousands of attempted sign-ins from confirmed compromise

The company links an AI-assisted campaign to abuse of a trusted application, while warning that authentication and application presence do not by themselves prove data theft.

Microsoft’s October 21 account of the ConnectWise Cloud Backup incident describes an AI-assisted campaign abusing an application that customers had already trusted. It attributes the activity to Storm-0940, a group it assesses as aligned with China, and identifies the ARTEX framework as an automation tool.

The distinction between attempted access and demonstrated impact is central. Microsoft says the actor attempted sign-ins to more than 2,250 tenants; that is not a count of 2,250 organisations proven to have lost data.

Several measurements describe different activity

In a separate campaign segment covering October 10–14, Microsoft recorded more than 151,000 failed sign-ins against 327 accounts across eight organisations. It says that segment showed no successful authentication or subsequent directory activity.

Elsewhere, the company observed follow-on activity in multiple affected environments. It cautions that an affected application’s presence, or even successful attacker authentication, does not necessarily establish data access or exfiltration.

These qualifications prevent a large attempted-login number from becoming an unsupported claim about the number of breached customers.

A trusted connection can carry risk

The reported route involved application credentials and existing permissions, rather than requiring each victim to interactively sign in. That makes the connection between a service provider and its customers part of the security boundary.

ConnectWise’s updates describe investigation and phased restoration, while saying existing backup archives remain encrypted, isolated and preserved with no indication of compromise. That statement about archives is separate from determining what happened in individual Microsoft 365 environments.

The incident illustrates how AI can accelerate an existing attack workflow. The public evidence needs to retain its precise units: targets, attempts, authenticated activity and confirmed impact are different findings.

Sources

- [AI-driven nation-state campaign using ARTEX enables supply-chain compromise](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/) — Microsoft Threat Intelligence - [ConnectWise Cloud Backup investigation updates](https://www.connectwise.com/company/trust/advisories) — ConnectWise