Backup app ke raste Microsoft 365 par AI agent attack: Microsoft ko kya mila aur kya check karein

21 October 2026 ko Microsoft ne bataya ki China state se juda ek hacking group ARTEX naam ke AI agent tool se machine ki speed par Microsoft 365 accounts par attack kar raha tha. Group ek backup app ke raste andar aaya, jise IT companies apne clients ke Microsoft 365 se jodti hain, isliye use kisi ka password nahi chahiye tha. Microsoft 365 use karne wale Indian business ke liye seekh un bahar ke apps ke baare me hai jinhe aapne apne email aur files tak aane diya hai. Ye update Microsoft ki report, ConnectWise ke advisory aur Microsoft ke help page par based hai, jo 22 October 2026 ko padhe gaye.

Kya hua: ek AI agent tool trusted backup app ke raste andar ghusa

• Group aur tool. Microsoft Threat Intelligence kehta hai ki China state se juda group, jise wo Storm-0940 kehta hai, September 2026 se ARTEX use karke saikdon organisations par attacks automate kar raha hai. Microsoft ke hisaab se ARTEX AI agents ka ek open-source set hai jo kisi bhi AI model ke saath attack chala sakta hai, "from reconnaissance through data exfiltration with little needed human interaction".
• Andar aane ka rasta. Group ne ConnectWise Cloud Backup (pehle SkyKick) ki app identities par kabza kar liya. Ye ek backup service hai jo Microsoft 365 se judi hoti hai. Kyunki in apps ke paas pehle se permission thi, group bina kisi user ke sign-in ke kaam kar saka (Microsoft ke shabdon me "without requiring an interactive user sign-in"). Microsoft kehta hai ki phir group ne 2,250 se zyada tenants (organisations ke Microsoft 365 accounts) me 2,900 sign-in attempts ek minute ki speed se sign in karne ki koshish ki.
• Speed. Microsoft ke hisaab se kai cases me pehle target se lekar cloud me badi access (privileged access) tak 3 ghante se kam laga.
• Andar kya kiya. Kuch accounts me AI agents ne aage jaanch-padtaal ki, app credentials badle aur apni access badhane ki koshish ki. Microsoft ye bhi kehta hai ki affected app ya successful sign-in "does not necessarily indicate that customer data was accessed or exfiltrated", aur uske apne systems compromise nahi hue.
• ConnectWise ne kya kiya. ConnectWise ne 16 October 2026 ko apna advisory publish kiya, 17 October 2026 ko saat app identities band kar di aur service rok di. 22 October 2026 ko usne kaha ki service ko phases me wapas chalu kiya ja raha hai. Wo ye bhi chetavni deta hai ki uske steps wo access nahi hatate jo attackers ne shayad pehle hi har customer ke account me bana li ho.

Kya pata nahi hai: attackers ko app credentials pehli baar kaise mile (ConnectWise abhi jaanch kar raha hai), asal me kitne organisations me breach hua, aur kya India me koi affected hai.

Small business ke liye ye kyun zaroori hai

Agar koi IT company aapka Microsoft 365 sambhalti hai, to usne backup, security ya licences ke liye extra tools jode honge. Aisa har app ek permission rakhta hai jo bina kisi password ke din-raat kaam karti hai. Jab inme se ek tool par kabza hota hai, to wo jin client accounts tak pahunchta hai, wo sab khatre me aa sakte hain.

AI speed badal deta hai. Microsoft likhta hai ki AI agents "can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously." Alert ke baad react karne ka time bahut kam bachta hai, isliye checks pehle hi karne honge.

Kise dhyan dena chahiye

• Wo businesses jinka email aur files Microsoft 365 par hain, khaaskar agar koi IT company use sambhalti hai
• IT partners aur service providers jo clients ke liye ConnectWise ya SkyKick tools use karte hain
• Har wo person jisne kabhi kisi app ke access maangne par "Accept" dabaya hai
• Un sectors ke businesses jinhe Microsoft ne targets me gina, jaise manufacturing, legal, financial services aur technology

Aapke liye kya badalta hai

Is week apne Microsoft 365 me kya check karein

1. Apne IT partner se likh kar poochhiye. Ye bhejiye:

Hello, Microsoft and ConnectWise have reported attacks through ConnectWise Cloud Backup (formerly SkyKick) apps in Microsoft 365. Please confirm in writing:

1. Whether any ConnectWise or SkyKick app is, or ever was, connected to our Microsoft 365.
2. If yes, whether our account has been reviewed with Microsoft's and ConnectWise's guidance, and what was found.
3. Which other outside apps have access to our email and files, and which of them we still need.

Thank you.

2. Dekhiye kin apps ke paas access hai. Administrator Microsoft Entra admin center me sign in karke Entra ID, phir Enterprise apps, phir All applications par jaye, koi app khole aur Permissions chune. Microsoft ka help page kehta hai ki iske liye Cloud Application Administrator jaisa role chahiye.
3. Jo access zaroori nahi, use hataiye. Microsoft salah deta hai ki aise apps ko sirf utni permissions dein jitni unhe chahiye. Har change apne IT partner se tay kijiye. ConnectWise app ko disable kijiye aur records rakhiye, jaisa Microsoft aur ConnectWise kehte hain.
4. Email me chupchap hue changes dhoondhiye. Microsoft review karne layak cheezon me mail forwarding, inbox rules aur delegated mailbox permissions ginata hai. Apne admin se aisi forwarding check karwaiye jo kisi ne set nahi ki.
5. Admin accounts ko surakshit rakhiye. Backup app ke galat use se pehle Microsoft ne isi group ko password-spray attack (bahut saare aam passwords, bahut saare accounts par) karte dekha: 151,000 se zyada fail sign-ins, ek bhi successful nahi. Har admin account par lamba, alag password aur two-step sign-in yahan madad karta hai. Ye step hamari salah hai, Microsoft ki nahi.

Phir ek rule banaiye ki koi bhi bina poochhe company email ya files se naya app nahi jodega: hamari guide team ke liye simple AI rules batati hai ki ise kaise likhein. Koi naya tool jodne se pehle hamari guide AI tool ke liye pay karne se pehle kya check karein ke questions poochhiye, jaise ki uska owner kaun hoga.

Aage kya dekhna hai

• ConnectWise ke reconnection instructions. Wo customers se kehta hai ki formal instructions aane tak affected connections band rakhein, aur restoration me kai din lagne ki ummeed hai.
• Wahi tool use karne wale aur attackers. Microsoft kehta hai ki kai regions ke threat actors ab ARTEX use kar rahe hain.
• Pehle credentials kaise chori hue. Iska pata chalne se dikhega ki IT companies jo doosre tools Microsoft 365 se jodti hain, unhe bhi yahi khatra hai ya nahi.

Pata nahi ki AI aapke business me safely kahan madad kar sakta hai? Free AI Business Checkup me lagbhag teen minute lagte hain.