Hackers Abuse ConnectWise Cloud Backup Credentials to Launch AI-Driven Microsoft 365 Attacks

Hackers abused compromised ConnectWise Cloud Backup application credentials to access Microsoft 365 environments, escalate privileges, and plant persistent credentials.

Microsoft attributed the campaign to Storm-0940, a China-state-aligned threat actor using ARTEX, an open-source agentic AI framework, to accelerate downstream attacks against more than 2,250 tenants.

Successful authentication, however, does not establish data theft.

Huntress initially disclosed the credential abuse on October 16, 2026. Its subsequent investigation supports Microsoft’s account but does not independently confirm ARTEX involvement.

Researchers assess LLM participation with low-to-medium confidence based on telemetry alone, rising to medium-to-high when they consider Microsoft’s attribution.

Attackers holding its authentication material could request Microsoft Graph tokens using permissions already granted within customer tenants, without an interactive user sign-in or MFA prompt.

On October 15, Huntress observed activity from 144.172.64[.]128 across almost 1,000 tenants, with more than 300 successful sign-ins.

This represents Huntress’s monitored subset, not a contradiction of Microsoft’s broader targeting count.

Huntress observed that, ConnectWise Cloud Backup, formerly SkyKick, uses application permissions to protect customer mailboxes, files, Teams content, and directory information.

ConnectWise Cloud Backup

In two investigated tenants, post-compromise activity included privileged role changes and credential planting.

The ConnectWise Cloud Management application for Microsoft Teams assigned itself Global Administrator and added secrets to other applications, including a tenant-specific Huntress application.

Those credentials could preserve access after containment of the original vendor application.

Huntress identified three operational patterns during October 15: scripted enumeration, operator-directed adjustments, and background tooling that continued after its target disappeared.

One enumeration sequence processed tenants in ascending identifier order using Python-urllib/3.12.

Separate bursts generated approximately 100 failed token requests within ten seconds, consistent with parallel worker threads rather than a model deciding each request individually.

The stronger indication of adaptive orchestration appeared during credential manipulation. After a certificate upload failed because of a thumbprint mismatch, another run followed 55 seconds later with retry logic absent from the earlier execution. Subsequent waits approximately doubled from 3.5 to 7.1 seconds.

Researchers also observed repeated “pilot, then batch” behavior: actions were tested against one tenant before being expanded.

These patterns fit an operator modifying tooling between runs, but cannot distinguish conclusively between a human, chatbot-assisted operator, or autonomous agent.

Microsoft describes ARTEX as a multi-agent framework that maps discovered assets and weaknesses, then pursues parallel attack paths. Several Storm-0940 operations reached privileged cloud access within three hours.

Evidence also challenges a fully autonomous interpretation. After a Teams service principal was deleted, requests continued every four to eight seconds for 22 minutes without adjustment.

Huntress lacked Microsoft Graph activity logs from the examined victims, obscuring request contents and potential data access. Application-only directory audit events also lacked source IP addresses.

Consequently, neither incomplete audit trails nor successful token issuance establishes whether information was exfiltrated.

Administrators should turn off affected application connections without deleting evidence, inspect service-principal sign-ins, and remove unauthorized credentials and role assignments.

Rotating vendor credentials alone will not eliminate separately planted backdoors.

Prioritize alerts for application self-assignment to privileged roles, unexpected credential additions, and deviations from normal vendor behavior.

Enable Microsoft Graph activity logging where supported and correlate activity across tenants; request cadence alone cannot reliably identify AI involvement.

Indicators of Compromise

Item	Description
144.172.64[.]128	Source of application sign-ins and Graph activity (ConnectWise advisory, our telemetry)
144.172.64[.]99	Cross-tenant password spray October 10 to 14 (ConnectWise advisory, Microsoft, our telemetry)
194.165.16[.]21	Possible link based on re-use of python-requests/2.31 in a password spray during the same timeframe
144.172.64[.]60	Listed in the ConnectWise advisory and by Microsoft
Python-urllib/3.12	User agent, enumeration and escalation tooling

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.