Security · October 22, 2026 · 5 min read

An AI agent tried 2,250 tenants at 2,900 sign-ins a minute

Microsoft says a China-linked group ran the ConnectWise backup-app compromise with an autonomous AI pentest framework. If your firm lives in Microsoft 365, the lesson is app trust and the first 72 hours.

On October 21, 2026, Microsoft published a profile of Storm-0940, an intrusion set it calls aligned with the Chinese state. What sticks with me isn't the tenant count. In multiple attacks, the time from initial targeting to privileged access ran under three hours. Software that doesn't sleep did the climbing.

What leaked was a trust relationship

The entry point was a stolen vendor credential, not a broken product. ConnectWise Cloud Backup, formerly SkyKick, backs up client Microsoft 365 for many managed service providers, and the job needs broad hands: mailboxes, files, Teams and directory data in every tenant that consented. The abused credential, Huntress found, was a client assertion living in ConnectWise's own tenant. Nothing a customer did in their environment could have produced it. The path exploited no Microsoft product vulnerability.

ConnectWise discovered the problem on October 14, 2026 and published its first advisory at 17:47 UTC on October 16. By then, on the morning of October 15, the application itself was signing into customer tenants from the hosting address 144.172.64.128, while legitimate traffic runs inside Azure's private space. ConnectWise disabled seven application identities by October 17 and on October 21 accepted Microsoft's attribution: a China state-aligned group that "used an openly available agentic AI framework to automate and speed up its operation."

Machine speed is the point

With the key in hand, the agents attempted sign-ins to more than 2,250 tenants at 2,900 a minute. Huntress counted sign-ins from that IP across almost 1,000 Entra tenants, over 300 successful, and 162 confirmed unauthorized by October 16. Before that, an October 10-14 spray of 327 accounts across eight organizations logged over 151,000 failures without one success. The spray got nothing; the stolen key got them everywhere.

Microsoft concedes the noise raises alerts, then adds: "the speed of the activity allows very little time for Defenders to respond." ARTEX, the tool in question, is an open-source multi-agent framework that runs an autonomous penetration test from reconnaissance through data exfiltration with little human interaction. Among the tenants Huntress watched the same infrastructure spray on October 13 and 14: four law firms. The attack arrives through the IT vendor, precisely the part firms of 20-200 people outsource.

Inside the tenant: fast and indiscriminate

The forensics show machine foraging, not targeted espionage. In two tenants Huntress examined, the agents granted themselves Global Administrator, then planted new credentials on a handful of other applications, some dated to expire in 2028, all of it running within two minutes around 03:45 UTC on October 15. The backdoor targets looked random: one tenant's secrets went to some of its least privileged apps, ignoring the powerful ones.

And containment isn't what people remember. Recon can vanish, since Graph directory reads leave no audit record by default, and disabling the app blocks new authentications but removes no credentials already added. ConnectWise agrees: their actions "do not reverse changes previously made inside a tenant," and each tenant still requires review for persistent access.

What a 20-200 person firm should copy from this

You can't out-type 2,900 sign-ins a minute. What you can fix is the arithmetic after the alert fires. Microsoft's guidance reads like a to-do list for a firm with one IT manager.

Start with inventory. Microsoft says to review every tenant where the affected application IDs are or were ever installed or authorized, searching by ID, dormant integrations included. A 40-person practice carries dozens of OAuth grants nobody has re-examined since somebody clicked Accept. Give each connection an owner, or retire it.

Then export before you remediate. Microsoft is explicit: do not delete enterprise applications as the first response. Preserve the Entra logs, then ask which service principal signed in from where, and which credentials or roles changed after October 1.

Finally, put the least-privilege question to your vendors in writing. One stolen secret became a master key across many tenants because backup tools get consented to read everything. Ask vendors and your MSP which tenant-wide permissions they hold, who reviews them, and what happens on a leak.

This is a story about SaaS identities, not model traffic, but the same math is why LLM Fusion exists. When prevention fails, and it eventually fails for everyone, surviving a client questionnaire means reconstructing what any identity saw and did from a log nobody could quietly edit afterward. That's why we hash-chain the audit trail and mask names, organizations, contacts and addresses, in English and Arabic, before a prompt reaches a model. It won't stop Storm-0940. It changes what shows up in the payload and what survives in the record.

Restoration takes days. The cleanup is manual.