The story in one sentence
The ConnectWise incident is a supply-chain security warning with an AI accelerator attached: attackers linked by Microsoft to the China state-aligned group Storm-0940 allegedly used ARTEX, an open-source agentic penetration-testing framework, to automate reconnaissance, password attacks and abuse of cloud application permissions after unauthorized access to ConnectWise Cloud Backup application credentials .
That distinction matters. The public headlines say “thousands,” and the scale is real, but the most careful reading is that more than 2,250 Microsoft 365 tenants faced attempted sign-ins or app-only access attempts through ConnectWise-related identities; public reporting has not established that all of those tenants suffered confirmed data theft . In other words, this was not one company’s bad password problem. It was a trusted vendor pathway turned into a force multiplier.
What appears to have happened
ConnectWise Cloud Backup, formerly SkyKick, is designed to integrate with Microsoft 365 environments so partners and customers can back up mailboxes, files and other cloud data. That kind of integration requires application identities and permissions, and those permissions are precisely why a compromise of the vendor channel can be so dangerous.
According to reports based on Microsoft’s threat intelligence, Storm-0940 obtained or abused ConnectWise application credentials and used them to authenticate into customer environments without needing an interactive user sign-in . That means conventional controls focused on a human logging in from a strange device or location may not be enough. A service principal can look like a legitimate business app right up until it begins changing credentials, enumerating data or seeking higher privileges.
The AI component is what changes the tempo. ARTEX is described as an agentic AI penetration-testing framework that can automate parts of the intrusion chain, including scanning, reconnaissance, password spraying and OAuth application abuse . In this case, the reported scale reached more than 2,250 cloud tenants, with Microsoft-linked reporting describing activity at roughly 2,900 to 3,000 sign-in attempts per minute , . For defenders, that is the enterprise equivalent of attackers finding a warp pipe: one trusted route, many downstream targets, very little time to react.
Breach, attempted access and the danger of sloppy numbers
The phrase “breaches hit thousands” captures the operational shock, but the numbers need discipline. TechCrunch reported that Chinese hackers spied on thousands of companies after breaching ConnectWise and cited Microsoft’s account that AI agents were used against around 2,250 organizations at nearly 3,000 attempted sign-ins per minute . Later analysis and security coverage stress the narrower interpretation: the 2,250 figure describes tenants targeted or reached by sign-in attempts, not a confirmed count of fully compromised companies .
That nuance does not make the incident small. Attempted access through a trusted application is already a serious exposure because it can bypass assumptions built into identity monitoring. Microsoft 365 administrators may have strong user MFA, device compliance and conditional access rules, yet still be exposed if a high-permission third-party application identity is abused. In several attacks associated with the wider ARTEX campaign, reporting says attackers reached privileged cloud access in under three hours from initial targeting .
A second set of numbers shows both the power and the limits of the automation. Reporting on Microsoft’s findings describes an earlier password-spray campaign against 327 accounts across eight organizations, generating more than 151,000 failed logons with no successful authentication in that specific campaign . That is not a cinematic AI mastermind quietly defeating every defense. It is high-volume, tireless automation testing many doors quickly. Good lockouts, strong credentials and phishing-resistant MFA can still matter. The problem is that the attacker can now rattle thousands of doors while defenders are still triaging the first alert.
ConnectWise’s response and current service posture
ConnectWise says it took protective action after unauthorized access to application identities associated with Cloud Backup, revoked certificates used for affected application connections and suspended Cloud Backup access while it investigated and restored services . The company’s status updates also said affected shared Cloud Backup credentials were no longer valid and that existing backup archives remained encrypted, isolated and preserved, with no evidence that those archives had been accessed .
That is reassuring only up to a point. ConnectWise also made clear that its Cloud Backup configuration does not give it full visibility into downstream partner and customer Microsoft 365 environments . So even if the vendor environment is contained, each customer or managed-service provider still has to examine its own tenant. Restoration of a backup service is not the same thing as eviction of an intruder from every downstream cloud environment.
By October 23, ConnectWise was still describing restoration as phased and security-validation dependent, with backup restoration access expected before full re-enrollment of services . It also told partners to keep affected application connections disabled until formal instructions applied to their service . That is the right instinct: reconnecting a trusted integration too early can recreate the same blast radius.
Why this is a supply-chain problem, not just an AI problem
The AI angle will dominate attention, but the deeper issue is trust concentration. Managed-service platforms, backup tools and remote-management systems sit in privileged positions because their business purpose is to administer, protect or restore other systems. When they work normally, they reduce operational burden. When they are compromised, they become scale amplifiers.
The ConnectWise case illustrates a pattern security teams have seen before: attackers do not need to phish every downstream customer if they can compromise a trusted intermediary. The new twist is that AI agents can compress the work of reconnaissance, credential testing and follow-on actions into minutes or hours. SC Media reported that ARTEX can coordinate multiple agents across attack stages with relatively little human intervention, which makes the operator less of a typist and more of a campaign director .
That matters for managed service providers especially. An MSP is both a customer of vendors and a vendor to its own clients. If it connects backup, management or security tools into hundreds of tenants, every permission grant becomes part of a shared risk model. The old question was, “Do we trust this vendor?” The new question is, “If this vendor’s app identity is stolen at 2 a.m., how quickly can we see, limit and revoke what it can do?”
What defenders should do now
The first priority is identity evidence preservation. Security teams should not simply delete suspicious enterprise applications before collecting sign-in logs, audit logs, app permissions, credential additions and role-assignment history. Deleting first can destroy the map needed to understand whether access became persistence.
Second, defenders should review service-principal sign-ins and Microsoft Graph activity related to ConnectWise Cloud Backup, SkyKick legacy integrations and any associated application IDs named in vendor guidance. The focus should be on successful and failed sign-ins, unfamiliar IP ranges, new credentials added to service principals, new owners, new consent grants, app role assignments and any attempt by an application to grant itself high privilege.
Third, customers and MSPs should rotate credentials and reduce permissions, but only after preserving evidence and understanding dependencies. A backup application may need meaningful access to do its job, but it rarely needs standing broad privilege forever. Least privilege, conditional access for workload identities, app-governance alerts and periodic consent reviews are no longer hygiene projects; they are incident-containment controls.
Finally, detection has to become faster than the attacker’s automation. A human analyst opening a ticket the next morning cannot compete with 2,900 attempts per minute. Organizations need machine-speed alerts for unusual app-only sign-ins, anomalous Graph calls, service-principal credential changes and sudden privilege grants. The ConnectWise episode does not prove AI makes attackers invincible. It proves that trusted channels plus autonomous tooling can turn minutes of exposure into thousands of downstream security decisions.
The bottom line
ConnectWise is the channel in this story, but the warning applies to every vendor whose software holds privileged access into customer environments. AI agents did not invent supply-chain risk. They made it faster, cheaper and easier to repeat. The practical answer is not panic; it is segmentation, credential rotation, least-privilege vendor access, log retention and automated detection tuned for application identities as much as human users.
The enterprise warp pipe has been found. Defenders now have to close it at machine speed.
Comments
Be the first to comment.