Threats · 6h ago
Microsoft linked Storm-0940’s breach of ConnectWise Cloud Backup to attempted sign-ins against more than 2,250 Microsoft 365 tenants, at nearly 2,900 per minute.
The attackers stole application credentials from the backup service and used them to sign in as an already-authorized connection, without a person completing an interactive login. That let ARTEX, an AI-enabled framework for automating penetration tests, drive rapid attempts and potentially reach customer email and files. In Storm-0940’s wider campaign, Microsoft saw privileged access achieved in under three hours in multiple cases.
ConnectWise has begun restoring Cloud Backup in controlled phases but told customers to keep connections disabled until directly instructed. For any Microsoft 365 tenant that trusted this service link, restoration of the backup service alone does not show that tenant-side access or persistence has ended; reporting does not establish how many targeted tenants were actually entered.
3 sources covering this story
Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise | TechCrunch
Microsoft points the blame for ConnectWise's breach at a China-aligned hacker, which relied on AI agents to rapidly hack into thousands of its customers.
The Record from Recorded Future
Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents
A Chinese government-aligned hacking group used automated tools to carry out the recent supply chain attack on IT management software company ConnectWise and is using the same techniques to try to compromise organizations around the globe, Microsoft said.
China-nexus actor linked to attack on ConnectWise Cloud Backup
Researchers said the hackers employed a powerful AI tool to accelerate and scale the attacks against hundreds of Microsoft 365 users.
Part of the PlainSec briefing for 2026-10-22