Microsoft ties ConnectWise hack to China-aligned group

Microsoft said on Wednesday, October 21, that Storm-0940 was behind the recent compromise of ConnectWise Cloud Backup. Microsoft describes Storm-0940 as a China-state aligned threat actor. According to the company, the group used an agentic AI penetration testing framework called ARTEX to automate its attacks, and "Storm-0940 used ARTEX to reach more than 2,250 tenants at 2,900 sign-in attempts per minute, a pace that leaves defenders with little time to detect and respond," Microsoft Threat Intelligence wrote.microsoft.com

This is the first public attribution for the incident. Before Wednesday, neither ConnectWise nor outside researchers had linked the attacks to a known group.cyberscoop.com

AI at machine speed

Microsoft said Storm-0940 has been active since 2021 and steals data from many industries. Starting as early as September 2026, it used ARTEX against hundreds of organizations. Targets included aerospace and defense, government, financial services, semiconductor firms and think tanks. In several cases the group gained privileged cloud access less than three hours after it first went after a target, according to Microsoft.microsoft.com

ARTEX is open source and works with any AI model. Microsoft calls it "a system of LLM-driven agents that run an autonomous penetration test from reconnaissance through data exfiltration with little needed human interaction." The company said threat actors in several regions are using it.cyberscoop.com

Microsoft traced a password-spraying campaign that ran from October 10 to 14 to the same infrastructure. It targeted 327 accounts across eight organizations and logged more than 151,000 failed logons, but none succeeded. On October 15, the AI agents signed in to customer tenants using stolen ConnectWise application credentials. In some environments they went on to run reconnaissance, change application credentials and alter privileged roles, Microsoft said.microsoft.com

Fallout for customers

The attacker used a compromised credential for the multi-tenant backup app, formerly called SkyKick, to get Microsoft Graph tokens without any user signing in. That meant multifactor authentication did not stop it. Huntress confirmed unauthorized sign-ins in 162 tenants. On October 17, ConnectWise disabled seven application identities and suspended Cloud Backup, SaaS Security and Cloud Management. The company said it has no evidence that backup archives were compromised.csoonline.com+2

On Wednesday, ConnectWise said it had started restoring services in phases and expects recovery to take several days. It also told customers to keep their connections disabled for now.cyberscoop.com

Unanswered questions

Microsoft did not say how many organizations were compromised. It also noted that a successful sign-in "does not necessarily indicate that customer data was accessed or exfiltrated." However, the credential changes made by the agents can stay in place as backdoors even after the original app is fixed, the company warned.microsoft.com

Microsoft executive vice president Igor Tsyganskiy said in a LinkedIn post that "since early October, a wave of AI-driven cyberattacks has been ongoing." He called the ConnectWise attack "one of many".cyberscoop.com