Microsoft has attributed a supply chain compromise at ConnectWise to a China-aligned actor that used an open-source AI penetration testing framework to push into more than 2,250 downstream Microsoft 365 tenants, at close to 2,900 sign-in attempts per minute.
What happened
ConnectWise reported unauthorised access to customer tenants through multiple OAuth application identities on 16 October 2026 and paused its cloud backup service while it investigated.
Microsoft attributes the intrusion to Storm-0940, an actor active since 2021. The group took application credentials that link ConnectWise's cloud backup platform to customer environments, then reused them against the tenants on the other side of that integration.
From 13 October, agents driven by the ARTEX framework handled reconnaissance, password spraying and OAuth application abuse. Microsoft recorded more than 151,000 failed sign-ins and 327 accounts targeted across eight organisations, with four application credentials producing over 200 sign-ins in under four minutes. In some environments the actor added or modified application credentials, which leaves persistence behind even after the original application is dealt with.
Microsoft's guidance is explicit that an affected application, or even a successful authentication, does not by itself prove data access. Confirming that requires correlating service principal sign-ins with Graph activity and directory changes.
Who is affected
- Organisations whose ConnectWise cloud backup integration held OAuth application credentials into Microsoft 365.
- Managed service providers, where a single stolen application credential can reach every tenant it was connected to.
- Any environment where one of the named service principals signed in from the Microsoft-published infrastructure addresses on or after 13 October 2026.
- Environments with application credential or privilege changes nobody on the team can account for.
What to do now
Hunt service principal sign-ins and Graph activity from 13 October, and treat any application credential change you did not make as a backdoor.
- Review service principal sign-ins, application credential and privilege changes, and Graph calls against the application IDs Microsoft published.
- Remove credentials added to OAuth applications that nobody on your team created.
- Preserve the logs before you rotate, then rotate. Rotation alone destroys the evidence and may leave the second credential in place.
- Follow ConnectWise's containment guidance before reconnecting the backup integration.
What this means for South African businesses
This is vendor risk in its purest form: nobody at the downstream company clicked anything, and the access arrived through a backup integration the client had approved. For an MSP the exposure compounds, because one stolen application credential reaches every tenant it was connected to, and a small team has no realistic chance of noticing 2,900 attempts a minute in a log. My assessment is that very few South African SMEs have ever reviewed which OAuth applications hold credentials into their Microsoft 365 tenant, which is exactly the gap this campaign was built to find.
Source: Microsoft Security Blog - AI-driven, large-scale nation-state campaign using ARTEX, published 21 October 2026.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.