The reported connection to ConnectWise
A compromised service credential can turn routine integration into a broad exposure — the same failure mode described in how a compromised SSO login can give attackers access to multiple enterprise applications. In this case, Dark Reading reports that a China-linked actor Microsoft tracks as Storm-0940 used compromised application credentials associated with ConnectWise Cloud Backup to attempt access to downstream Microsoft 365 tenants. The article describes the activity as a supply-chain attack, while making clear that the initial route by which attackers gained control of the application identities had not been publicly explained. Source: Dark Reading
Dark Reading says ConnectWise disclosed unauthorized access to application identities associated with its Cloud Backup product on Oct. 16. The report also describes a broader Storm-0940 campaign beginning as early as September, aimed at hundreds of organizations worldwide in industries including manufacturing, aerospace, chemicals, energy, defense, and financial services. These are reported campaign details, not proof that every organization in those sectors was affected. Source: Dark Reading
ARTEX and the attempted tenant access
Dark Reading reports that Storm-0940 used an AI-enabled penetration-testing framework called ARTEX to accelerate reconnaissance and scanning, password spraying, and OAuth application abuse — a class of abuse that persists after authentication, as covered in why MFA fails against OAuth consent abuse. In the ConnectWise incident, the attackers attempted sign-ins to more than 2,250 downstream customer tenants, with activity reaching as many as 2,900 sign-in attempts per minute, according to the report’s account of Microsoft’s findings. Those figures describe attempted access; they should not be read as a count of confirmed compromises. Source: Dark Reading
The distinction matters. Dark Reading says that in multiple instances attackers obtained privileged access to an organization’s cloud infrastructure in less than three hours after initial targeting, while also reporting Microsoft’s assessment that the majority of targeting was unsuccessful. A fast attempt rate and some successful intrusions are serious. Neither fact establishes that all targeted tenants were breached, or that data was taken. Source: Dark Reading
What the activity involved
The article describes AI-accelerated follow-on activity through Microsoft Graph in multiple affected environments. Microsoft, as quoted by Dark Reading, observed reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access. The wording is important: the report describes attempts to modify privileges, not a confirmed privilege change in every environment. It also does not establish that a particular data set was exfiltrated. Source: Dark Reading
The broader account places ARTEX in offensive-security workflows—automating and accelerating familiar activity rather than replacing the underlying access problem. The reported list includes scanning, password spraying, and OAuth application abuse. It gives no complete breakdown of successful password guesses, affected sign-ins, or the relative contribution of automation to each stage. Precision beyond that would imply evidence Dark Reading does not provide. Source: Dark Reading
Service response and customer guidance
Dark Reading reports that ConnectWise suspended Cloud Backup and also took its SaaS Security and Cloud Management services offline after the incident. In an Oct. 22 update, the company said restoration work was continuing and urged customers to keep affected ConnectWise application connections offline until further notice. The disruption is part of the incident’s practical cost: organizations may need to assess the security event while also checking what backup coverage remains available. Source: Dark Reading
The article reports that ConnectWise said existing backup archives remained encrypted, isolated, and preserved, with no indication of compromise. That is the company’s reported statement, not a basis for broad claims about every customer environment or the absence of other impact. The available report does not document data theft. Source: Dark Reading
Dark Reading says Microsoft’s mitigation guidance included reviewing each Microsoft 365 tenant that might have been connected to ConnectWise and preserving logs and other forensic evidence before making changes. ConnectWise also directed customers to its investigation and remediation guidance. For affected organizations, the source-supported actions are straightforward: follow the vendor’s current instructions, identify potentially connected tenants, and preserve evidence before making changes. The article does not supply a universal checklist or substitute for the vendors’ incident-specific instructions. Source: Dark Reading
The recovery question
Containment and service restoration can pull in opposite directions. Dark Reading quotes security practitioners advising affected organizations to understand what may have happened in their environments before reconnecting, and to examine unauthorized application-credential changes that could provide a route back in. They also emphasize checking whether backups are running during the disruption and verifying backup jobs and recovery after a connection is restored. These are expert recommendations reported by Dark Reading, not a claim that every customer has the same recovery status. Source: Dark Reading
The same report quotes advice to preserve sign-in and audit records and investigate application sign-ins, Microsoft Graph activity, new credentials, privilege changes, and unusual data access. That guidance reflects the activity described in the article; organizations should use the vendor’s current remediation guidance to decide what applies to their environment. Source: Dark Reading
What the numbers do—and don’t—say
The figures make the breadth of attempted access plain: more than 2,250 tenants and up to 2,900 sign-in attempts per minute. The reported sub-three-hour interval in some instances underscores that privilege access could follow initial targeting quickly. But the article also says most targeting was unsuccessful. These metrics do not tell readers how many individual customers suffered confirmed access, which sign-ins succeeded overall, or whether information was stolen. Source: Dark Reading
That limit is worth keeping in view when describing AI’s role. Dark Reading reports Microsoft’s attribution of ARTEX use and its account of accelerated reconnaissance and attack activity. It does not provide a controlled comparison showing how long the campaign would have taken without the tool. The grounded conclusion is narrower: the framework was used to automate and accelerate the reported operations, while the precise effect on campaign speed and overall impact is not quantified in the article. Source: Dark Reading
For customers, the immediate priority is not to infer a breach from a high attempt count—or to assume safety because most targeting failed. Follow the reported guidance to review potentially connected tenants, preserve relevant evidence, and keep affected application connections offline in line with ConnectWise’s instructions. Then verify the situation in the affected environment and coordinate service restoration with the provider. Dark Reading’s reporting supports those measured steps; it does not establish one outcome for every downstream organization. Source: Dark Reading