Research reportsMicrosoft / ConnectWise

Microsoft tracks AI-accelerated cloud intrusions: application permissions also need checking

Microsoft reports that attackers used ARTEX to accelerate abuse of third-party cloud application identities and permissions. In addition to user logins, check application credentials, permission changes and subsequent access.

Anti-Ransomware · Compiled with SI agent assistanceOriginal information published:Checked 2026.10.26
Original composite illustration of identity passes and separation boundaries between third-party services
Illustration · Source ↗ · About this image ↗

Source Facts

In research published on 21 October, Microsoft said activity tracked as Storm-0940 used the ARTEX agent framework to accelerate cloud application abuse in the ConnectWise Cloud Backup incident. Such activity can use permissions already granted to applications and may not require users to log in again.

Microsoft observed new credentials and permission changes in some environments. This does not establish that every customer with the application installed suffered data exposure; the supplier also asks customers to check each environment individually. Attribution of the attackers is the research team's assessment.

ConnectWise confirmed unauthorised access to application credentials and took containment and phased recovery measures. Disabling the initial connection may not automatically remove other access established earlier, so follow-up review of audit records remains necessary.

Next Steps for Businesses / Editorial Observations

Cloud application permissions should have owners, least privilege and regular reviews, just like employee accounts.

Next steps you can take

  • If you use the affected service, follow ConnectWise's official recovery instructions and preserve investigation records.
  • Have administrators check application logins, new credentials, authorisations and unusual data access.

Original sources

Reporting leads · The Hacker News

The original material listed above has been traced. Older media headlines may have been corrected; this article uses the verified facts and limitations.

AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of a software package conveyor and a master key stored separatelyIllustrationSupply chain security · 2026.10.24

LiteLLM explains package compromise: exposed keys must be revoked to complete the response

LiteLLMOriginal synthetic illustration of an old certificate being removed from a glass certificate chainIllustrationSecurity updates · 2026.10.24

Oracle updates Java trust certificates, removing affected eMudhra root certificates

OracleOriginal synthetic illustration of a bookshop owner and developer checking an access credential replacement checklistIllustrationIncident Reports · 2026.10.24

Railway updates incident response information: users still need to revoke and replace sensitive credentials

Railway