Wiz says AI agents are running hands-on intrusions
Named cases include ARTEX at Korean banks and ConnectWise, Hermes at Thailand's finance ministry, and AI-assisted API attacks in Japan.
68
Vendor
ConnectWise
- Mentions · 7d6
- Mentions · 30d39
- All mentions57
- First seenAug 31, 2026
- Last mentioned2d ago
Timeline
57 articles · newest firstWiz says AI agents are doing hands-on intrusion work
Named cases include ARTEX and Hermes, plus three Wiz investigations that begin with an exposed Flowise service.
68
Storm-0940 targeted 2,250 Microsoft 365 tenants with stolen ConnectWise credentials
Microsoft says the ARTEX agent framework drove the campaign; Huntress rates the AI claim lower from its own telemetry.
78
Storm-0940 abused ConnectWise backup credentials in Microsoft 365
Microsoft says more than 2,250 tenants were targeted; Huntress confirmed hundreds of sign-ins but not data theft or ARTEX use.
78
Huntress post looks at a ConnectWise attack
The supplied page is site navigation, so method, victims, and whether a flaw was used are not stated.
28
Critical PHP2Shell flaws patched in PHP; PAN-OS still unfixed
CVE-2026-109618 and CVE-2026-109619 are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; Palo Alto has no PAN-OS fix yet.
76
Storm-0940 used AI tool Artex in ConnectWise customer intrusions
Microsoft logged more than 151,000 failed logons and successful sign-ins with ConnectWise cloud application identities.
80
Kroll: tech-firm breaches drove most third-party victim impact
From June 2025 to June 2026, tech compromises accounted for 60% of all breach victims Kroll counted.
48
Microsoft links ConnectWise breach to Storm-0940 using AI tool ARTEX
Stolen application credentials were used against 2,250 Microsoft 365 tenants, with privileged access in under three hours in some cases.
82
Microsoft links Storm-0940 to ConnectWise Cloud Backup attack
Compromised Cloud Backup application credentials were used to target more than 2,250 Microsoft 365 tenants.
80
Chinese hackers used stolen ConnectWise backup credentials to reach customers
Microsoft says AI agents drove nearly 3,000 sign-in attempts a minute against about 2,250 organizations.
78
Microsoft ties ConnectWise backup abuse to Storm-0940 and ARTEX
Sign-in attempts hit 2,900 a minute, with more than 111,000 failures on October 11 alone.
82
Storm-0940 used ConnectWise credentials against 2,250 Microsoft 365 tenants
Microsoft says the China-linked group used ARTEX and reached privileged cloud access at some organizations in under three hours.
82
Storm-0940 used ARTEX against over 2,250 Microsoft 365 tenants
Stolen ConnectWise application credentials enabled Graph access; a separate spray of more than 151,000 logons had no successful authentication.
76
Storm-0940 used ARTEX in ConnectWise Cloud Backup supply-chain attack
Microsoft says the agents targeted more than 2,250 tenants at up to 2,900 sign-in attempts per minute.
84
Microsoft attributes ConnectWise supply-chain attack to Storm-0940
The group used ARTEX to reach more than 2,250 tenants at 2,900 sign-in attempts per minute; compromise counts are unstated.
82
Storm-0940 used ARTEX AI in ConnectWise supply-chain attacks
Microsoft says privileged cloud access sometimes took under three hours, with more than 2,250 tenants targeted.
84
ConnectWise Cloud Backup API secret used against Microsoft 365 tenants
Huntress saw malicious sign-ins across almost 1,000 Entra tenants, with more than 300 appearing to succeed.
78
ConnectWise resets Cloud Backup credentials after unauthorized access
Huntress saw vendor-credential sign-ins from 144.172.64.128, then Global Administrator grants and new secrets on two tenants.
78
ConnectWise suspends Cloud Backup after supply-chain credential attack
Huntress saw unauthorized sign-ins in 162 Microsoft 365 tenants after attackers used the backup app’s permissions.
78
ConnectWise disables Cloud Backup after Microsoft 365 logins
Researchers say ConnectWise credentials signed into customer Microsoft 365 tenants; downstream impact is unconfirmed.
74
Weekly recap: BeyondTrust zero-day, ConnectWise access, Ledger thefts
Armory Castle used CVE-2026-102764 for file operations, then planted SAWFLY and BARECLAW on a few victims.
78
ConnectWise Cloud Backup breach page lacks incident details
The supplied SOCRadar page is site navigation and does not describe what was accessed or who was affected.
28
ConnectWise suspends Cloud Backup after attackers abuse Microsoft 365 access
Huntress saw the stolen app credential sign into at least 162 Microsoft 365 tenants on October 15; earlier tokens may still work.
78
ConnectWise suspends cloud services after M365 tenant access
Huntress says a Cloud Backup client assertion reached 162 Microsoft 365 tenants on October 15–16.
78
ConnectWise backup credential used to enter Microsoft 365 tenants
Huntress reported suspicious sign-ins across 162 organizations; ConnectWise disabled seven app identities and three cloud services.
76
ConnectWise takes cloud services offline after Microsoft 365 access
Unauthorized access to Cloud Backup application identities was found after October 15; restoration timing and any data theft remain unconfirmed.
78
Stolen ConnectWise app credentials used against Microsoft 365 tenants
Seven application identities were disabled and Cloud Backup suspended; Huntress saw about 300 successful sign-ins.
78
ConnectWise suspends Cloud Backup after unauthorized app-identity access
Huntress says a stolen Cloud Backup Microsoft 365 API secret was used in customer tenants.
78
ConnectWise disables cloud apps after Microsoft 365 tenant access
Seven application identities were disabled October 17; Huntress says a later wave against 16 tenants failed.
80
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
Hackers abused ConnectWise Cloud Backup identities to access at least 162 Microsoft 365 tenants.
82
Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups
Stolen ConnectWise Cloud Backup credentials accessed 162 Microsoft 365 tenants, forcing ConnectWise to halt backups.
78
Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts
Attackers used a stolen ConnectWise Cloud Backup secret to access 173 Microsoft 365 tenants.
85
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Attackers used a compromised ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 tenants.
80
ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
Huntress says abused ConnectWise Cloud Backup credentials accessed at least 162 Microsoft 365 tenants.
84
What Cybersecurity Leaders Must Prioritize in 2027
Huntress urges leaders to prioritize RMM abuse, AI-enabled crime, social-engineering loaders, and multi-extortion ransomware.
32
Microsoft Power BI Phishing Campaign Deploys Rogue ScreenConnect RMMs for Persistent Access
Huntress found a Power BI phishing campaign that installs rogue ScreenConnect clients for persistent Windows access.
62
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
Huntress reports phishing that abuses Microsoft Power BI links to install rogue ScreenConnect RMM clients.
61
Hackers Abuse Legitimate ScreenConnect Tool to Gain Remote Access Through Phishing
Phishers sent a fake payment notice that installed a legitimate ScreenConnect client aimed at their server.
54
ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st)
Attackers phish victims into running a signed ScreenConnect client that calls an attacker instance.
50
Related CVEs
by mentions- CVE-2026-84869<1%9.9Missing authorization in ScreenConnect client allows unauthorized file execution
- CVE-2024-1709100%10.0Authentication Bypass in ConnectWise ScreenConnect Creates Rogue Admin Accounts
- CVE-2025-39354%7.2ViewState Code Injection in ConnectWise ScreenConnect May Lead to RCE
- CVE-2026-3564<1%9.0A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain…
- CVE-2026-10276419%9.3Message-origin spoofing enables file ops on BeyondTrust Remote Support
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-420169%8.8Token Scope Validation Flaw Enables Privilege Escalation in JFrog Artifactory
- CVE-2026-4201810%7.5Improper Authentication in JFrog Artifactory Exposes Internal Anonymous Tokens
Appears with
- Microsoftvendor · 34
- Microsoft 365product · 30
- Huntressorganization · 25
- ConnectWise cloud backupproduct · 22
- ScreenConnectproduct · 18
- Storm-0940threat actor · 13
- ARTEXmalware · 11
- Microsoftorganization · 11
- ConnectWiseorganization · 11
- Cloud Managementproduct · 9
- SaaS Securityproduct · 8
- Cloud Backupproduct · 7
- Microsoft Entra IDproduct · 6
- Microsoft Graphproduct · 6
- Exchange Onlineproduct · 5
- ConnectWisevictim · 5
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.