:quality(90):no_upscale()){kind=logo}
AI-Driven Supply Chain Attack Gained Privileged Cloud Access in Under Three Hours
STATUS: Nation-State Supply Chain Campaign SEVERITY: 8/10 AUDIENCE: Government, Defense, Critical Infrastructure Security Leads
Nov 6, 2026
·Blog
·Secure Communications
:quality(90):no_upscale())
Microsoft attributes the ConnectWise Cloud Backup compromise to Storm-0940, a China-state-aligned actor that used the agentic AI penetration-testing framework ARTEX against hundreds of organizations across sectors that include government, military, aerospace and defense, and energy. Using stolen application credentials, the agents attempted sign-ins to more than 2,250 downstream Microsoft 365 tenants and in multiple cases reached privileged cloud access less than three hours after initial targeting. The speed leaves defenders little time to coordinate a response.
What Happened
Agents that work around the clock compressed the path from targeting to privileged access to less than three hours.
On October 21, Microsoft attributed the recently disclosed ConnectWise supply chain compromise to Storm-0940, a China-state-aligned actor active since 2021 that targets organizations across multiple industries for data theft. Since at least September, the actor has used ARTEX, an open-source multi-agent system that runs an autonomous penetration test from reconnaissance through data exfiltration, against hundreds of organizations globally. The sectors include aerospace and defense, energy, financial services, government, and the military.1
ConnectWise disclosed unauthorized access associated with Cloud Backup on October 16. The actor took control of several ConnectWise cloud application identities and used them to authenticate to customers' Microsoft 365 environments as the applications without an interactive user sign-in. Agents attempted sign-ins to more than 2,250 tenants and Microsoft says most of the targeting was unsuccessful. In some environments they went on to Microsoft Graph and directory operations, including application credential changes and changes involving identities, groups, and privileged roles.1
Microsoft's data shows the pace. In a password-spray phase from October 10 to 14, the same infrastructure produced more than 151,000 failed logons against 327 accounts at eight organizations, peaking at 2,900 failures per minute, with no successful authentication. Microsoft's figure for the downstream phase shows over 200 sign-ins in under four minutes using four application credentials and in multiple instances privileged access less than three hours after initial targeting.1
Persistence is the lasting risk. Microsoft says the credential changes made by the actor's agents can persist through other identities, credentials, and cloud services, and can remain as a backdoor after the original compromised application is remediated. Microsoft also observed secrets being read at scale across multiple Azure Key Vaults.1
Microsoft's containment guidance has organizations keep the affected ConnectWise application connections disabled, preserve configuration and evidence before making irreversible changes, review every tenant where the applications were installed or authorized, and review sign-in and audit records from at least October 15. Microsoft also notes that the speed of AI-driven activity leaves defenders little time to respond to alerts and remediate the actor's access in a coordinated way.1 That guidance has to be carried out by a team whose own Microsoft 365 environment, including email and Teams, is in scope of the investigation.
What They Found and What It Means
Finding | What It Means | Operational Consequence | Open Question |
Storm-0940 used ARTEX agents to attempt sign-ins to more than 2,250 tenants and, in multiple instances, reached privileged cloud access in under three hours. | Agentic AI compresses the path from targeting to compromise to a window shorter than most incident response processes assume. | Alerts may fire only after privileged access exists, so response begins with the attacker already in position. | How many organizations have a response process that can contain a cloud compromise within hours, including outside business hours? |
The actor authenticated as trusted vendor applications that customers had already authorized without an interactive user sign-in. | Controls built around user sign-ins, including user MFA, have no step to act on. | Exposure depends on which vendor applications hold privileged access to a tenant, regardless of how well users are protected. | How many organizations can list every third-party application with privileged access to their tenant and the permissions each holds? |
The actor's credential changes can persist after the original compromised application is remediated and Microsoft's guidance is to preserve evidence before making irreversible changes. | Containment is a careful sequence of steps and runs while the tenant may still be accessible to the attacker. | The team coordinating containment is working inside the environment under investigation, with its own email and chat in scope. | Whether response plans specify how the team communicates when the tenant hosting email and chat is itself under investigation? |
Why This Matters
Old Assumption | Current Reality | BlackBerry Response |
A response team can coordinate through the organization's normal email and chat during a cloud compromise. | Microsoft's guidance puts every tenant where the affected applications were authorized in scope, and the actor has historically used compromised applications to access and exfiltrate email through Microsoft Graph. | BlackBerry® AtHoc® is designed to reach staff on mobile devices and phones, outside the organization's internal email and network, so coordination can continue while the tenant is under investigation. |
Disabling a compromised integration is a quick, self-contained step. | Containment involves disabling the applications, preserving evidence, reviewing audit records from at least October 15, and weighing the effect on backup and restore workflows, often across many tenants and teams. | BlackBerry AtHoc can coordinate that sequence across teams and regions with confirmation of receipt. BlackBerry® SecuSUITE® gives responders a secure channel for sensitive decisions. |
MFA and user protections cover the paths into a Microsoft 365 tenant. | App-only authentication through an already-authorized vendor application involves no interactive user sign-in for those protections to act on. | BlackBerry AtHoc and BlackBerry SecuSUITE address the response phase since controlling vendor application permissions is an identity function outside these products. |
Recommended Actions
IMMEDIATE | Identify every tenant where the affected ConnectWise applications are or were installed or authorized, searching by application ID and not display name, and keep those connections disabled until ConnectWise provides restoration instructions. |
IMMEDIATE | Preserve Entra sign-in and audit records and Microsoft 365 audit data before making irreversible changes and review service principal sign-ins and credential, role, and privilege changes from at least October 15. |
SHORT-TERM | Inventory third-party applications with privileged access to your tenants, apply least privilege to their permissions, and monitor credential additions and privilege assignments. |
SHORT-TERM | Agree how the response team will communicate and make decisions if the tenant hosting email and chat is under investigation and test that channel. |
ONGOING | Plan response timelines around machine-speed attacks since Microsoft reports privileged access can be reached in under three hours. |
BlackBerry Position
Microsoft's report describes an attack whose speed is the point: agents that work around the clock moved from targeting to privileged access in hours through a vendor application that customers had already trusted. Defenders get little time and the work of containing it falls on a team whose own tenant is part of the investigation. Organizations that plan for that case, with a coordination channel outside the environment under investigation, can run the response without relying on the systems the attacker may be inside.
Citations:
1. Microsoft Threat Intelligence and Microsoft Security Research, AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise, (Microsoft Security Blog, October 21, 2026, updated October 26, 2026).
:quality(90):no_upscale())