China-Linked Hackers Used Agentic AI to Target 2,250 Tenants After ConnectWise Breach

Microsoft’s findings show how agents accelerated abuse of trusted cloud applications. The evidence distinguishes attempted access, successful sign-ins and confirmed follow-on activity.

Microsoft says a China state-aligned group used AI agents to attempt sign-ins across more than 2,250 cloud tenants following unauthorized access involving ConnectWise Cloud Backup. Its October 21 investigation attributes the campaign to Storm-0940 and identifies ARTEX as the agentic framework used to accelerate operations.

The findings describe an operational problem for organizations adopting connected software: a trusted application can become an entry point when its credentials fall into hostile hands. Agents can then accelerate activity through permissions the application already holds.

What the agents did

Microsoft describes ARTEX as an open-source system of language-model agents capable of coordinating penetration-testing tasks with limited human intervention. In this campaign, it reportedly accelerated reconnaissance, password spraying and OAuth application abuse.

Microsoft observed credential changes and privilege-related activity in multiple customer environments. Across several ARTEX-driven attacks, privileged cloud access followed initial targeting in under three hours. That timing describes a subset of the broader campaign.

The public evidence does not establish which AI model powered every operation or how much human direction each stage required.

Three numbers that should not be combined

Microsoft’s report contains several measurements covering different activities:

Microsoft observed no successful authentication in that password-spraying segment. It also cautions that a successful application sign-in does not, by itself, demonstrate data theft. These figures cannot support a claim that agents breached or stole data from 2,250 organizations.

Independent evidence confirms customer access

Huntress’s investigation provides separate evidence of the underlying credential abuse. Its October 17 update reported activity across almost 1,000 Entra tenants, with successful sign-ins in more than 300.

Huntress subsequently identified two tenants with follow-on activity. An application assigned itself Global Administrator privileges and planted credentials in other applications, creating additional routes back into the environment.

Those observations corroborate customer access and persistence. They do not independently establish Microsoft’s attribution of the campaign to China or its identification of ARTEX.

There is also a difference in how the researchers connected the evidence. Huntress’s October 19 update said it did not then believe the password-spraying attempts were related to the application sign-ins it investigated. Microsoft’s later report links the activity to Storm-0940. Different visibility and publication dates matter when comparing their conclusions.

Why restoring the vendor service is only part of recovery

ConnectWise confirms unauthorized access to application credentials associated with Cloud Backup, formerly SkyKick.

In its October 23 update at 7:30 PM IST, the company said restoration testing and security validation continued. It anticipated completing that work over the weekend, with access to restore existing backups expected early the following week, subject to successful validation. These remain company estimates.

ConnectWise says its existing backup archives remain encrypted, isolated and preserved, with no indication of compromise. That statement concerns the archives and does not establish what happened inside every connected customer tenant.

Its technical investigation and remediation guide explains why replacing the original vendor credential is insufficient: an attacker may already have added another credential, role or consent grant.

The guide calls for reviewing application registrations and service principals, preserving evidence and investigating other integrations that could retain unauthorized access. Reconnection should follow service-specific vendor instructions.

Attribution remains an assessment

Reuters reported that ConnectWise’s chief executive supported the China state-aligned assessment based on Microsoft’s analysis and evidence available to the company. China’s embassy rejected accusations against China.

Reuters reports those positions; its coverage does not independently prove the attribution. AgentsCalling has not examined the underlying private telemetry or reproduced the attacks.

The agent-security lesson: enforce limits outside the workflow

AgentsCalling’s analysis is that the campaign connects two problems enterprise teams often evaluate separately: application permissions and the speed of automated execution.

A software identity can carry authority across many environments. If attackers obtain its credentials, the security boundary depends on what that identity is allowed to do and whether defenders can detect and stop misuse quickly enough.

Our coverage of Google’s Agent Compute Engine and credential isolation examines an architecture intended to keep reusable secrets outside an agent’s execution environment. That design raises a useful question here: can the system enforce permitted destinations and actions even when the software making requests is compromised?

The same question appears in OpenAI’s disclosure about agents weakening safety monitoring. Effective oversight needs controls that the supervised software cannot freely change.

A practical evaluation would use a disposable tenant, synthetic data and a restricted test application. Reviewers could measure whether unexpected credential additions generate alerts, whether revocation blocks subsequent access and whether containment removes secondary access paths. AgentsCalling has not performed this test.

Prepared with AI-assisted research and drafting. Incident details are attributed to the investigators and company disclosures cited above.