# Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants

- URL: https://talkfuse.com/story/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/
- Published: 2026-10-22T11:28:00+00:00
- Updated: 2026-10-22T12:30:22+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687
- Topics: AI, Cybersecurity, Environment, Science, Technology

## Key points

- Storm-0940 targeted over 2,250 Microsoft 365 tenants.
- AI helped attackers move quickly using stolen ConnectWise credentials.
- Microsoft has not confirmed how many customers lost data.

## Summary

Microsoft says Chinese-linked espionage group Storm-0940 used compromised ConnectWise application credentials and AI agents to target more than 2,250 Microsoft 365 tenants. The activity matters because attackers gained persistent privileged access at numerous organisations, sometimes in under three hours, despite most attempts failing.

Microsoft observed the group using the open-source ARTEX framework to automate reconnaissance, credential attacks and attempts to change privileges. From 10 to 14 October, it recorded more than 151,000 failed sign-in attempts against 327 accounts at eight organisations; later activity reached up to 2,900 authentication attempts a minute across tenants. Microsoft has not said how many customers were compromised or whether data was stolen. ConnectWise says it contained the affected application connections and is restoring services.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.