AI Agents Attacked Companies Through a Vendor: What to Review

On October 21, 2026, Microsoft revealed that a hacker group linked to the Chinese state used artificial intelligence agents to attack hundreds of organizations around the world. The attack did not start with the victim: it started with a vendor. The attackers took the credentials of a cloud backup service from the company ConnectWise, and used the trust that customers had given that service to try to get into more than 2,250 company accounts on Microsoft 365. The same week, Reuters showed another hacker using AI agents to break into the websites of more than 100 companies. Below, what happened, why this also matters to a small business, and what to review this week.

October 24 update: what we learned afterward

In the days after the announcement, ConnectWise and NorForge published more details. What changed the picture:

• The affected service is Cloud Backup, formerly SkyKick. On October 17, ConnectWise shut down the seven application identities used by the service and revoked the connection certificates. As a result, backups stopped for all customers. As a precaution, it also took offline two services tied to it, SaaS Security and Cloud Management.
• All accounts and passwords were changed. On October 19, the company completed a full rotation of accounts and credentials in the affected environment and says it has seen no successful action by the attackers since the early hours of October 17.
• The stored copies were not touched, as far as is known. According to ConnectWise, the backup files remain encrypted, isolated, and show no sign of access. But it warns that it has no way to see whether each customer's Microsoft 365 account suffered any change: each one needs to be reviewed by whoever administers it.
• The return is slow and in stages. Restoration began on October 21. In the October 23 update, the plan was to finish testing over the weekend, release recovery of existing backups first early the following week, and only then reactivate the full service.
• NorForge's full report is out. The researcher found more than 20 Cairn panels exposed on the internet with malicious activity, in three groups. The largest, Chinese-speaking, had more than 1,100 attack projects against online stores with 200,000 to 1.5 million visits, chosen automatically by traffic. Another group, English-speaking, aimed at stealing cards and cryptocurrencies. On average, about 10% of attempts succeeded.

The practical lesson became clearer: for more than a week, customers of this service were left without new backups and unable to restore the old ones. Those who had a second copy somewhere else got through the problem without a scare.

What Microsoft found

The report from Microsoft's threat intelligence team describes a group it calls Storm-0940, active since 2021 and known for stealing company data. What's new is the tool. Since September 2026, the group has been using ARTEX, an open-source program in which several AI agents work together to carry out an entire attack, from reconnaissance of the target to data exfiltration, with little human involvement.

The report's numbers give a sense of the scale:

• More than 2,250 company accounts on Microsoft 365 received access attempts using the credentials stolen from the vendor.
• Less than 3 hours separated, in several cases, first contact with the target from administrator access to the company's cloud.
• More than 151,000 password attempts were recorded between October 10 and 14 against 327 accounts at eight organizations, peaking at 2,900 attempts per minute on October 11.

There are two caveats from Microsoft itself worth repeating. Most of the attempts failed. And the fact that a company had the affected application, or even that the attacker managed to get in, does not prove that data was stolen. Microsoft also states that the attack did not exploit any flaw in its systems.

How a vendor became the way in

When a company hires a backup service for its emails and files, it authorizes that service to get into its account. That is how backup works: the service needs to read everything in order to store everything. That authorization stays active all the time, without anyone needing to type a password.

That trust is what the attackers used. With the ConnectWise application's credentials in hand, the AI agents entered customers' accounts as if they were the backup service itself. In some cases they went further: they listed users and permissions, created new credentials to ensure they could come back, and tried to raise their own privileges. Microsoft warns that these changes can keep working as a back door even after the vendor fixes the problem.

ConnectWise published its first notice on October 16 and later expanded its guidance. For customers, Microsoft's recommendation is to keep the application connections turned off until ConnectWise advises on the return, to save the access logs before deleting anything, and to review activity since October 1.

The week's other attack: store websites

On October 19, Reuters published the investigation by researcher Snorre Fagerland, of the security company NorForge. A Chinese-writing hacker gave AI agents instructions of fewer than 100 characters and let them work on their own. Since September 25, the agents have tried to break into more than 1,200 e-commerce sites in the United States, Canada, Australia, and Japan, and managed to get into more than 100 companies, including Deere, SharkNinja, and Cummins.

Each successful break-in took, on average, about 23 hours of attempts and cost something close to US$50 in AI usage, according to the researcher's estimate. In one case, the agents found no flaw in a large company's main site, went looking for other addresses tied to it, and found an exposed control panel. At Cummins, the site hit belonged to a vendor. We cover that case in the post on AI finding security flaws faster than companies fix them.

Why this matters to a small business

It is tempting to think that an attack by a government-linked group is a problem for banks, chip factories, or ministries. Three points show why that is not quite so:

1. The target was chosen through the vendor, not by size. Anyone using the affected service made the list, big or small. An attack like this hits all of a vendor's customers at once.
2. The cost of attacking has plummeted. With agents working day and night, testing a thousand companies costs almost the same as testing ten. The small company is no longer “too small to be worth it.”
3. Speed removes reaction time. In under three hours, the attacker can be inside. Whoever only looks at alerts the next day arrives too late.

None of this is cause for panic. The measures that stop most of these attacks are simple, cheap, and within reach of any company. Microsoft's password attack, for example, generated 151,000 attempts and no access: the accounts were protected and the lockout after too many attempts worked.

What to review this week

1. List who has access to your email and your files. In your Google Account, in the Security area, there is a list of connected third-party apps and services. In Microsoft 365, the administrator finds the authorized applications in the Entra admin center, under Enterprise applications. For each item, ask: do we still use it? Who authorized it? Does it need to read everything or only part of it?
2. Remove what nobody uses. That email signature app tested in 2022, the scheduler that was replaced, the reporting tool a former employee installed. Every forgotten authorization is a door left open.
3. Ask your vendors what they do. Whoever handles your backup, your IT, or your website has privileged access. Ask how they protect their own credentials, whether they use two-step verification, and how they would notify you of an incident. If the answer is vague, that is already an answer.
4. Turn on two-step verification everywhere. Email, website panel, hosting, domain, bank. It is the measure that blocks the most password attacks, whether carried out by people or by AI.
5. Keep an eye on forwarding rules. One of the signs Microsoft says to look for is new rules that forward emails outside or move messages without you knowing. Check your inbox rules from time to time.
6. Have a copy that doesn't depend on a single vendor. The attacked service was precisely a backup one. Keeping a second copy of your most important data, somewhere else and disconnected, ensures that a problem at the vendor doesn't become a total loss.
7. Review forgotten sites and your store platform. The agents in the store campaign got in through secondary pages and vendors' sites. An old promotion microsite, a test store, and a blog on another address need an owner or need to be taken offline. And if your store runs on a platform installed on your own server, such as Magento, confirm that it and its old components are up to date: the NorForge report cites flaws in old parts of this kind of system.

If you are a ConnectWise customer or use a provider that uses ConnectWise

Many small companies don't contract ConnectWise directly, but have an IT company that uses its tools to look after customers' computers and backups. It is worth asking your IT provider whether it uses ConnectWise's Cloud Backup and, if so, what has already been done. The published guidance is: keep the application connection turned off until official release, don't delete the application before saving the logs, look for access and permission changes since October 1, and change the credentials wherever there is a sign of misuse.

AI is also on the defenders' side

The same kind of tool that speeds up the attack speeds up the defense. Security programs already use AI to spot unusual access within seconds, and Microsoft's own report lists automatic alerts for this attack. Analysts quoted by the specialized press argue that blocking suspicious credentials should be automatic, with human review afterward, precisely because the agent's speed leaves no time to wait for someone to read the alert.

For a small company, the practical translation is to choose vendors that have this kind of protection and not depend on someone checking everything by hand. We also showed how this scenario began, with agents attacking Taiwanese government agencies, in the post on open attack tools using AI agents.

What is still unknown

• How many companies had data stolen. Neither Microsoft nor Reuters could say. Getting in is not the same as taking something.
• Whether the two attacks are connected. The one by the Storm-0940 group and the one by the store hacker used different tools, ARTEX and Cairn, and no source links them.
• Who is behind each one. Storm-0940's link to the Chinese state is Microsoft's assessment. The store hacker remains without a known identity.

How we work

At our agency, the sites we build and maintain have two-step verification on their panels, monitored updates, and an inventory of what is online, including microsites and old pages. If you don't know who has access to your website, your hosting, and your domain, we can do that survey with you. Learn about our website creation service.

Sources

• Microsoft Security Blog, “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise”, October 21, 2026.
• ConnectWise, Cloud Backup incident status page, updates from October 16 to 23, 2026.
• NorForge, report “Inside Cairn”, October 19, 2026.
• Reuters, exclusive investigation on AI agents and the websites of more than 100 companies, October 19, 2026.
• CSO Online, coverage of the attack on more than 2,250 Microsoft 365 accounts, October 22, 2026.