Artificial intelligence is transforming cybersecurity, but the same capabilities designed to help security professionals identify weaknesses can also be misused to accelerate sophisticated cyberattacks.
A recent campaign linked by Microsoft to a China-aligned threat actor highlights this growing concern. The group, tracked as Storm-0940, reportedly used ARTEX, an AI-powered penetration testing framework, to automate reconnaissance, password spraying, and follow-on attacks targeting organizations worldwide.
The activity also involved the abuse of trusted ConnectWise application connections to reach downstream Microsoft 365 environments. This incident demonstrates how AI-driven automation, combined with compromised application access, can turn a weakness in one part of the technology ecosystem into a broader supply chain security concern.
1. What Happened in the ConnectWise Attacks?
On October 21, 2026, Microsoft published findings linking Storm-0940 to a campaign that exploited a compromised multi-tenant ConnectWise application to target customer environments.
Microsoft reported that the activity began as early as September 2026 and affected hundreds of organizations across multiple industries.
The threat actor reportedly used ARTEX to automate several stages of its operations, including:
- Reconnaissance: Identifying potential targets and gathering information about exposed systems and cloud environments.
- Password spraying: Attempting commonly used passwords against multiple accounts to gain unauthorized access.
- Application abuse: Using compromised or improperly secured application connections to authenticate to Microsoft 365 environments.
- Privilege escalation: Attempting to obtain additional permissions that could provide broader access to cloud resources.
- Persistence: Modifying application credentials or permissions to maintain access after initial compromise.
Microsoft reported that some attacks achieved privileged cloud access in less than three hours from initial targeting.
While most targeting attempts were unsuccessful, the speed and scale of the activity demonstrate how automated tools can reduce the time defenders have to investigate suspicious behavior and contain an intrusion.
2. What Is ARTEX, and Why Does It Matter?
ARTEX is an AI-driven penetration testing framework designed to automate security testing activities. It can work with large language models to coordinate tasks that would otherwise require substantial manual effort.
When used within an authorized security assessment, automation can help security professionals discover weaknesses, evaluate exposure, and improve remediation efforts.
However, the same capabilities can be misused when operated without authorization.
In the reported campaign, ARTEX helped accelerate offensive activities such as scanning, reconnaissance, and credential attacks. Automated agents can operate continuously, perform multiple tasks in parallel, and adapt their activities based on results.
This creates several challenges for defenders:
Greater attack speed: Automated operations can progress from reconnaissance to unauthorized access much faster than traditional manual attacks.
Increased attack volume: A single operation can generate large numbers of authentication attempts and application requests across multiple targets.
Reduced response time: Security teams may have less time to investigate alerts, determine the scope of an incident, and revoke compromised access.
More complex investigations: Automated activity can generate extensive logs and involve multiple identities, applications, and cloud services.
The important distinction is that AI does not eliminate the need for traditional attack techniques. Instead, it can make those techniques faster, more scalable, and harder to contain.
3. Why the ConnectWise Supply Chain Connection Is Significant
Third-party integrations are essential to modern IT operations. Organizations rely on external platforms for backup, monitoring, administration, automation, and cloud management.
However, these integrations may receive permissions that allow them to access sensitive systems and information.
When a trusted application is compromised, attackers may be able to exploit the existing relationship rather than attack every downstream organization independently.
In the ConnectWise incident, Microsoft described activity involving application-based authentication to Microsoft 365 customer environments. Some of the observed behavior included reconnaissance through Microsoft Graph and attempts to modify application credentials and privileges.
This illustrates three important security concerns.
Excessive application permissions
Applications should receive only the permissions necessary to perform their intended functions. Broad permissions can increase the potential impact of compromised application credentials.
Blind trust in third-party integrations
A previously approved application should not be assumed safe indefinitely. Its authentication patterns, permissions, and administrative activity must be monitored continuously.
Persistence beyond initial containment
Disabling an affected integration may prevent further activity through that connection, but it does not automatically remove credentials, permissions, or other persistence mechanisms that an attacker may have established in a customer environment.
Organizations must therefore investigate their own cloud tenants rather than relying solely on a vendor’s containment measures.
4. What Should Organizations Do Now?
Organizations using ConnectWise Cloud Backup or related affected application connections should follow the vendor’s official instructions and Microsoft’s published investigation guidance.
Immediate security actions
1. Review affected integrations
Identify whether the affected ConnectWise applications are present or were previously authorized in your Microsoft 365 tenants. Review application identities and permissions rather than relying only on display names.
2. Follow official containment instructions
Keep affected application connections disabled until ConnectWise provides formal restoration guidance. Confirm the status of the specific integration with the vendor before re-enabling it.
3. Preserve evidence before making changes
Retain relevant Microsoft Entra sign-in records, audit logs, Microsoft 365 activity records, and SIEM telemetry. Preserve application configuration and investigate suspicious changes before making irreversible modifications.
4. Investigate application authentication
Review successful and failed service-principal sign-ins for unfamiliar sources, unusual activity patterns, and behavior outside expected operating conditions.
5. Examine permission and credential changes
Look for unexpected application credential additions, new application owners, unfamiliar consent grants, privileged role assignments, and changes to service-principal permissions.
6. Revoke unauthorized access
When suspicious activity is confirmed, remove unnecessary permissions, revoke compromised access, rotate affected credentials, and investigate whether additional identities or resources were compromised.
7. Hunt for suspicious cloud activity
Review Microsoft Graph activity for unexpected directory enumeration, unusual permission discovery, credential changes, or attempts to modify administrative privileges.
8. Validate recovery before restoring trust
Before re-enabling affected integrations, verify that remediation is complete, access permissions are appropriate, and monitoring is in place to detect renewed suspicious activity.
Authentication by an affected application does not, by itself, prove that customer data was accessed or stolen. Organizations should correlate authentication events with subsequent activity to determine the actual impact.
5. Strengthening Defenses Against AI-Accelerated Attacks
This incident also highlights the need for security controls that can respond at the speed of automated threats.
Organizations should consider the following long-term measures:
- Adopt least-privilege access: Limit permissions assigned to users, service principals, and third-party applications.
- Strengthen identity security: Enforce strong authentication, conditional access policies, and appropriate protections for privileged identities.
- Improve behavioral monitoring: Detect unusual authentication patterns, unexpected application activity, and abnormal changes to permissions.
- Automate defensive response carefully: Use security orchestration to accelerate alert triage and containment while retaining appropriate human oversight.
- Assess third-party risk: Review vendor security practices, integration permissions, incident notification procedures, and recovery processes.
- Conduct regular penetration testing: Test cloud environments, application integrations, identity controls, and external attack surfaces under authorized conditions.
- Prepare for supply chain incidents: Establish response procedures that cover both the affected vendor and the organization’s own environment.
- Review AI security governance: Define how AI-driven security tools may be used, who can authorize them, and how their activities are monitored and audited.
AI-powered security tools should be governed with the same care as other powerful technologies. Organizations need visibility into what these tools can access, which actions they can perform, and how their behavior is controlled.
6. Which Industries Are Most at Risk?
Microsoft reported targeting across a broad range of sectors, including aerospace and defense, financial services, government, manufacturing, energy, technology, and nonprofit organizations.
The implications extend to other industries that depend on cloud platforms and third-party integrations.
Financial services: Strengthen cloud identity controls and protect sensitive financial and customer information.
Healthcare: Secure cloud applications and third-party integrations that support administrative and clinical operations.
Manufacturing and energy: Improve visibility into enterprise cloud environments and protect connections between IT management systems and critical business operations.
Government and defense: Enforce strict application authorization, privileged access controls, and incident reporting procedures.
Technology and managed service providers: Assess the security of multi-tenant services, limit cross-customer exposure, and establish clear procedures for responding to compromised integrations.
For all these sectors, effective security requires visibility across identities, applications, infrastructure, and vendor relationships.
Conclusion: Defending Against AI Requires Speed, Visibility, and Control
The reported ConnectWise attacks demonstrate how AI-driven tools can accelerate established cyberattack techniques and increase the risk associated with trusted application integrations.
The challenge is not simply that attackers are using AI. It is that automated operations can exploit weaknesses in identity security, application permissions, and supply chain relationships before defenders have sufficient time to respond.
Organizations should prioritize application access reviews, continuous cloud monitoring, rapid incident response, and regular testing of their security controls. They should also verify the integrity of third-party integrations and investigate their own environments after a vendor-related incident.
As AI continues to evolve, resilient cybersecurity programs must combine intelligent automation with strong governance, well-defined access controls, and experienced security professionals.
About COE Security
COE Security partners with organizations in financial services, healthcare, retail, manufacturing, and government to secure AI-powered systems and ensure compliance.
Our offerings include:
- AI-enhanced threat detection and real-time monitoring
- Data governance aligned with GDPR, HIPAA, and PCI DSS
- Secure model validation to guard against adversarial attacks
- Customized training to embed AI security best practices
- Penetration Testing (Mobile, Web, AI, Product, IoT, Network & Cloud)
- Secure Software Development Consulting (SSDLC)
- Customized CyberSecurity Services
Follow COE Security on LinkedIn for ongoing insights into safe, compliant AI adoption.
COE Security helps organizations identify vulnerabilities, assess cloud and application security, evaluate third-party risks, strengthen identity controls, and improve incident response readiness. Our penetration testing and cybersecurity consulting services help businesses identify security gaps and build stronger defenses against evolving threats.
Follow COE Security on LinkedIn for the latest cybersecurity developments, practical security recommendations, and insights to help your organization stay informed and cyber safe.
Click to read our LinkedIn feature article