Microsoft blames China-aligned group for ConnectWise attack using AI agents
Microsoft says the group Storm-0940 used an open source AI tool called ARTEX and stolen ConnectWise application credentials to target more than 2,250 Microsoft 365 tenants. In some environments, the attackers gained privileged access in under three hours.
ConnectWise disclosed the breach on October 16 in a security advisory about its Cloud Backup product, formerly SkyKick. The company took the service offline and began restoring it in stages on October 21. It disabled seven application identities on October 17.
Microsoft said the attackers used identities of ConnectWise cloud apps that already had access, so they did not need user sign-ins. Sign-in attempts peaked at 2,900 attempts per minute. In some environments, the AI agents changed application credentials, groups and privileged roles.
Reports said 162 tenants had confirmed breaches by October 16. The security firm Huntress said more than 300 tenants had successful sign-ins. A ConnectWise spokesperson said there was "no indication" that backup data had been compromised.
Microsoft said Storm-0940 has operated since at least 2021. It said the group targets defence, government, law, energy and semiconductor manufacturing.
Key facts
- Who
- Microsoft (company that attributes the blame for the breach to a China-aligned hacker); ConnectWise (IT company that was breached); Storm-0940 (China-state-aligned threat actor, according to Microsoft); Microsoft Threat Intelligence (published the findings on Storm-0940)
- What
- According to the description, Microsoft attributes the ConnectWise breach to a China-aligned hacker, who relied on AI agents to rapidly hack into thousands of ConnectWise customers. Only a headline and description were available, so details are limited.
- When
- 22 October 2026
- Status
- Reported