decrypted · 24 october 2026 · vulnerabilities and patching · supply chain · ai and llm security

Microsoft names the group behind the ConnectWise breach, and says AI agents sped it up

This week's ConnectWise story has moved. On 21 October Microsoft published its assessment that a China-aligned group it tracks as Storm-0940 was behind the compromise of ConnectWise's Cloud Backup service, and that the group used ARTEX, an AI penetration testing framework, to turn stolen access into entry to customer Microsoft 365 tenants. In some cases it took under three hours from first targeting to privileged access.

What Microsoft says happened

Microsoft tied the activity to ConnectWise by matching public IP addresses from that incident to ones in its own investigations. According to reporting on its findings, the attackers obtained credentials for several ConnectWise cloud application accounts, then signed in to customer Microsoft 365 environments through applications those customers had already authorised. No user had to log in.

Microsoft counted 2,250 tenants targeted at up to 2,900 sign-in attempts a minute. It said most of the targeting failed, but the group achieved privileged cloud persistence at many organisations in a short time. The AI role is Microsoft's assessment, and it says ARTEX can run a penetration test from reconnaissance to data theft with little human input.

The hotel keycard

OAuth is the standard that lets one app act for you inside another. Think of it as a staff keycard a hotel issues to its laundry supplier. The supplier does not need a guest's room key, because the card opens the doors it was issued for. A thief who steals the supplier's card never picks a lock and never triggers a guest alarm. ARTEX is that thief with a hundred pairs of hands, trying every door on every floor at once.

What the defender sees

There is no user prompt, so a second check such as MFA, multi-factor authentication, never fires. The traces are in the directory: Microsoft Graph reconnaissance, new credentials added to applications, and attempted changes to identities, groups and privileged roles.

A warning for those who have cut ConnectWise off: reporting on the Microsoft findings suggests reviewing credentials added to applications since at least 1 October, not only from the 15th when the breach became public, because persistence can outlast revoking the vendor connection.

The Secure by Design lesson

The design decision that would have helped is least privilege with an expiry date. A backup supplier rarely needs standing, tenant-wide access. Three questions are worth asking this week:

Which third-party apps hold permissions in our Microsoft 365 tenant, and who approved them?
Does each one need what it was granted, and does the grant ever lapse?
If an alert fires at 02:00, does anything contain it before a human wakes up?

The first two cost an afternoon in the admin console. The third costs more, but at 2,900 attempts a minute a rota of tired people is not a control. Ask your managed service provider (MSP), your outsourced IT firm, the same questions.

Also this week

A patched flaw that stayed open. Kaspersky published research on 22 October into BlackX, a UEFI bootkit, meaning malware that loads before Windows itself. It abuses the Baton Drop flaw to switch off Secure Boot, and was used against diplomatic agencies in Central Asia. Kaspersky attributes it to APT41 with medium confidence. The design point is uncomfortable: BleepingComputer's account says victims were running patched Windows, because the patch does not revoke the old Windows Production PCA 2011 certificate automatically. Administrators must do that by hand. That certificate expired on 19 October, but Kaspersky notes expiry alone does not stop vulnerable files loading. Its advice is to apply the patches, complete the revocation steps, and run endpoint protection with exploit prevention. Kaspersky also found the exploit very similar to BlackLotus, a bootkit whose source leaked in 2023, so techniques do not stay with one actor. A fix that needs a second, manual step is half a fix.

A deadline with a date on it. Windows Server 2016 reaches the end of extended support in January 2027, and Microsoft's lifecycle page and BleepingComputer agree on that month. After the final January update there are no more security fixes, and that is under twelve weeks away. Support for the Essentials edition's Remote Web Access feature ends the same day. Microsoft points to Windows Server 2025 and offers a free 180-day trial for testing. For UK organisations the question is rarely the migration itself but the forgotten server nobody owns. Build the inventory now, because an unsupported server holding customer data is a hard position to defend to the ICO, the UK's data regulator, after a breach.

Sources

If any of this touches your estate, get in touch.