A single stolen login credential sat quietly inside a backup app used by thousands of small businesses.
Then, over four days in October, something started hammering it thousands of times a minute.
No night shift of hackers was typing those logins by hand.
A piece of software was doing the typing, the guessing and the breaking in, on behalf of a group that had used it before.
What actually ran that attack, and how did it move so fast?
How a machine, not a person, drove the break in
The mechanism here is simpler than it sounds. An open-source toolkit called ARTEX lets anyone wire a large language model directly into the plumbing of a cyberattack, and Microsoft describes ARTEX as a system of LLM-driven agents that can use any AI model to run an autonomous penetration test from reconnaissance through data exfiltration with little human interaction , so instead of a person typing commands, the model reads a goal and writes its own scripts to chase it.
That pace breaks manual defenses outright. “Agents are not constrained by factors affecting humans,” Microsoft wrote; they can “work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously.”
So the agent did much of the deciding itself. Once it found a working login, it moved into mapping the network, hunting for higher privileges and pulling in more credentials, chaining each step the way an assembly line hands a part from one station to the next without stopping.
Inside the break in, hour by hour
The target was not a government network or a bank vault. It was a quiet piece of backup software called ConnectWise Cloud Backup, formerly known as SkyKick, the kind of tool an IT contractor installs once and forgets about.
That made it a perfect doorway. “Storm-0940’s use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in,” Microsoft said.
After gaining control of several app identities, the agents kept using the same block of addresses to sign into customer environments, borrowing trust the app had already earned.
Once inside, the pace was built for machines, not people. Following the breach at ConnectWise, Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 tenants at 2,900 attempts per minute. And in some cases, attackers achieved “privileged access to an organization’s cloud infrastructure” in “less than 3 hours” from initial targeting.
What the evidence shows, and who is behind it
A threat intelligence unit published its findings on the group, tracked as Storm-0940, on October 21 in a security blog post that walks through the kill chain in granular detail.
Microsoft Threat Intelligence named the China state-aligned actor Storm-0940 as the one behind the recent ConnectWise supply chain attack. ConnectWise didn’t initially identify who was responsible, but Microsoft has now pointed the finger at Storm-0940, a China-linked espionage crew that’s been operating since at least 2021. That history matters.
It shows the group did not invent new tradecraft here. It simply bolted an AI agent onto tactics it already knew, which is why investigators could tie the campaign to a familiar actor so quickly.
ConnectWise disclosed the unauthorized access on October 16 and subsequently suspended its Cloud Backup, SaaS Security, and Cloud Management services while investigating and restoring them. Two teams converging on the same timeline is part of what makes it credible.
How the numbers were actually counted
The headline figures come from two different things Microsoft tracked, not one. In the October 10-14 password-spray campaign against 327 accounts at eight organizations, Microsoft recorded more than 151,000 failed attempts and observed no successful authentication in that campaign.
The 2,250-tenant, 2,900-attempts-a-minute figures describe a different stage: the stolen ConnectWise application credentials being used to authenticate directly into customer tenants. Microsoft says Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 tenants, at up to 2,900 sign-in attempts per minute. That is a count of targets, not breaches.
Microsoft says most of the targeting failed. Even so, the actor got privileged cloud persistence at “many” organizations in a short time , which is the detail that keeps the episode from being either a non-event or a total compromise.
Where the automation still breaks down
Even so, the picture is not of a flawless robot hacker. Peak activity came on 11 October, at about 2,900 failures per minute and more than 111,000 failures in a single day; 48 accounts absorbed more than 1,000 failures each, and lockouts accounted for nearly 98 per cent of all activity.
Thousands of login guesses failed for every one that landed, which is closer to brute force at scale than to an unstoppable intelligence quietly outsmarting defenders.
A similar pattern showed up last year, in an unrelated incident. An AI developer disclosed a separate case in which attackers leaned on its own coding tool for cyber espionage, and the company later said Claude frequently overstated findings and occasionally fabricated data during autonomous operations, claiming to have obtained credentials that didn’t work .
None of that makes the ConnectWise campaign less serious. The “autonomous” label covers a tool that is fast and tireless rather than flawless, closer to the agentic systems now routing tasks across multiple AI models for legitimate developers than to a thinking adversary working alone.
What changes now for defenders and ordinary accounts
For a small business whose email runs through Microsoft 365, the practical lesson is blunt. The weak link was never the big-name platform, it was a smaller vendor plugged into it with standing trust.
Reviewing which outside apps hold access to a company inbox, and cutting ones nobody remembers approving, now matters as much as a strong password.
Microsoft frames this as a preview of a broader shift. “This activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and allows them to scale their operations exponentially,” Microsoft said , language that doubles as a warning to every company running a trusted third-party plug-in.
That same automation is already reshaping legitimate software work, where AI-driven code merges have surged inside major labs. The tools are cheap, open and improving fast, and they do not care whose hands are on the other end, which is exactly why the fix has to be structural rather than personal.
