AINews 'Black October' roundup clusters AI-linked security disclosures
The digest says many incidents were found earlier and disclosed together, while exploitation scale is disputed.
38
Victim
ConnectWise
- Mentions · 7d8
- Mentions · 30d8
- All mentions8
- First seenOct 19, 2026
- Last mentioned2d ago
Timeline
8 articles · newest firstChinese hackers used stolen ConnectWise backup credentials to reach customers
Microsoft says AI agents drove nearly 3,000 sign-in attempts a minute against about 2,250 organizations.
78
Microsoft ties ConnectWise backup abuse to Storm-0940 and ARTEX
Sign-in attempts hit 2,900 a minute, with more than 111,000 failures on October 11 alone.
82
Storm-0940 used agentic AI against 2,250 Microsoft 365 tenants
After a ConnectWise Cloud Backup compromise, sign-in attempts hit 2,900 a minute and some tenants saw privileged access in under three hours.
82
Microsoft says Storm-0940 used AI to breach ConnectWise tenants
The group attempted more than 2,250 tenant sign-ins at about 2,900 per minute, often gaining access within three hours.
82
Storm-0940 used ARTEX against over 2,250 Microsoft 365 tenants
Stolen ConnectWise application credentials enabled Graph access; a separate spray of more than 151,000 logons had no successful authentication.
76
Storm-0940 used ARTEX in ConnectWise Cloud Backup supply-chain attack
Microsoft says the agents targeted more than 2,250 tenants at up to 2,900 sign-in attempts per minute.
84
ConnectWise takes cloud services offline after Microsoft 365 access
Unauthorized access to Cloud Backup application identities was found after October 15; restoration timing and any data theft remain unconfirmed.
78
Appears with
- Storm-0940threat actor · 6
- Microsoft 365product · 6
- ARTEXmalware · 6
- ConnectWise cloud backupproduct · 5
- Microsoftvendor · 5
- ConnectWisevendor · 5
- Microsoftorganization · 3
- Cloud Managementproduct · 2
- Cloud Backupproduct · 2
- CrowdStrikeorganization · 2
- SaaS Securityproduct · 2
- Zscalerorganization · 2
- Grokai model · 1
- Google Workspaceproduct · 1
- DeepSeekai model · 1
- Claude Codeai model · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.