A breach of ConnectWise's cloud backup service became a vehicle for what Microsoft describes as agent-driven espionage at industrial scale.
Intelligence Lead
Microsoft has attributed a supply-chain compromise of ConnectWise's cloud backup application to Storm-0940, a China-aligned actor, and reports that roughly 2,250 Microsoft 365 tenants were compromised. Microsoft assesses that the pace of activity, reported at around 3,000 attempts per minute, points to agentic AI tooling rather than human operators. If sustained, the model collapses the time between stolen credential and tenant-wide access.
Situation Report
Microsoft published its findings on 21 October. According to the company, attackers breached ConnectWise's cloud backup application and obtained credentials, which were then used against customer Microsoft 365 environments. Reporting by CSO Online and The Register, both published within a day of the disclosure, puts the number of affected tenants at approximately 2,200 to 2,250. The discrepancy between figures is minor and reflects rounding across outlets.
Microsoft attributes the activity to Storm-0940 and describes the actor as China-aligned. The company links the intrusion speed to an automated tooling set it calls ARTEX, which it characterises as agentic: software that plans and executes intrusion steps with limited human direction. The reported rate of roughly 3,000 attempts per minute is the principal basis for that assessment. It is Microsoft's inference, and independent verification has not been published.
The data accessed in the compromised tenants has not been publicly detailed. Neither Microsoft nor ConnectWise has, as of this writing, released a victim list by sector. The espionage characterisation rests on the actor's attribution and on the target profile rather than on a confirmed exfiltration inventory.
Background & Context
Managed-service and backup vendors hold privileged, standing access across many customers, which makes them a recurring target for state-linked actors. Compromising one provider yields reach into hundreds or thousands of downstream environments without per-victim intrusion work. The pattern is well documented in earlier China-attributed operations against remote management and identity infrastructure.
What distinguishes this case is the reported automation. Public reporting through 2026 has described criminal use of AI agents against scores of sites. A state-aligned actor applying comparable tooling to a trusted-vendor foothold would represent a step up in scale, if Microsoft's characterisation holds. It also tests the assumption that rate-limiting and anomaly detection tuned to human tempo will catch credential abuse in time.
Analysis & Assessment
It is assessed with moderate confidence that this incident reflects a deliberate shift toward agent-assisted intrusion by a Chinese state-aligned actor, rather than a one-off experiment. The supply-chain entry point and the breadth of tenants are consistent with collection-oriented planning. The thin public detail on data accessed is the main limit on confidence.
The likely trajectory is replication. Tooling that works against one backup provider is portable to other managed-service vendors, and defenders should expect similar speed in future intrusions. Organisations that relied on multi-factor authentication as the primary barrier may find it bypassed where stolen tokens or backup-service credentials sit outside the normal authentication path; this has been reported by secondary outlets but is not confirmed by Microsoft in the material reviewed.
For policymakers, the case sharpens the argument for vendor-level security obligations and for government attribution that does not depend solely on the affected platform's own telemetry. A corroborating advisory from US or allied agencies would materially raise confidence.