The ConnectWise break-in was run by software, at 2,900 sign-in attempts a minute

Last weekend ConnectWise switched off its own Cloud Backup service after somebody used its application credentials to sign into customers' Microsoft 365 accounts. At the time the figure was about 300 successful sign-ins. Microsoft published the rest of the story on 21 October, and it is a good deal larger than that.

Microsoft attributes the campaign to Storm-0940, a China-state aligned group it has tracked since 2021, and says the attackers were not typing. They were driving ARTEX, an open-source penetration testing framework built as a multi-agent system around a large language model, which handles everything from reconnaissance to stealing the data with very little human involvement. The numbers it produced are the point. More than 2,250 tenants attempted. Over 2,900 sign-in attempts a minute. Over 200 successful sign-ins in under four minutes using four application credentials. In several cases, under three hours from first contact to privileged access. In four days ending on 14 October it threw 151,000 failed logins at 327 accounts across eight organisations.

Microsoft's own summary is the line to remember: agents "can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously." Guessing passwords used to be slow enough that nobody bothered with an ordinary person's account. That constraint has gone. Which means the gap between a password you reuse everywhere and one you use once has stopped being theoretical, and anything protecting an email account should be a passkey or a long unique password, not your dog's name and a number.

Most of this fight happens on servers you will never see. Tendvane's security posture check covers the part that is genuinely yours, including whether BitLocker is actually encrypting the drive it says it is.