Microsoft links ConnectWise breach to China-aligned hackers using AI agents

A connection meant to protect company data became a route into customer systems. Microsoft disclosed on October 21 that China state-aligned hackers known as Storm-0940 compromised ConnectWise Cloud Backup and used ARTEX AI agents to accelerate attacks. The attackers abused stolen application identities to enter customers’ Microsoft-hosted environments through software those customers had already trusted.

Cloud Backup, formerly SkyKick, is a backup and recovery service delivered through managed service providers—companies that run IT systems for other businesses. It protects Microsoft 365 and Google Workspace data. That arrangement puts the service between a technology provider and the customer information it helps safeguard.

The attackers borrowed an application's trust

Microsoft traced a critical change to October 15, when the attackers gained control of identities belonging to multiple ConnectWise cloud applications. Application credentials establish data connections between ConnectWise and its customers. Stealing them gave the attackers a way to authenticate to customer environments using permissions already granted to those applications.

The route did not require an interactive user sign-in, Microsoft said. Rather than persuading each customer to log in, the attackers could act through a previously authorized application. The stolen credentials could enable access to email and other files in customers’ Microsoft-hosted systems.

ARTEX supplied automation around that access. It is an AI penetration-testing framework: software designed to test systems for security weaknesses. Microsoft said Storm-0940 used it to speed up scanning, reconnaissance, password spraying and abuse of application permissions. Here, the AI’s reported role extended beyond writing code to carrying out steps inside an attack.

Failed logins and customer access are different measures

Before the application-identity abuse, Microsoft observed a password-spraying campaign from October 10 through 14. It targeted 327 accounts across eight organizations and generated more than 151,000 failed logins. Failures peaked at 2,900 per minute on October 11. Microsoft detected no successful authentication, token issuance or directory changes during that period.

In the ConnectWise incident, Microsoft said the attackers attempted to sign in to more than 2,250 Microsoft 365 tenants, or customer environments. That is a measure of attempted access, not a confirmed count of successfully breached organizations. Microsoft described the pace of the activity as leaving defenders little time to detect and respond.

Some activity went further. Microsoft assessed that agents progressed into reconnaissance, application-credential modifications and changes involving identities, groups and privileged roles. It warned that credential changes could create persistent access through other identities or cloud services, leaving a backdoor even after the original compromised application was remediated.

Huntress offered a narrower, independently observed perspective. Principal security operations analyst Jon Semon told Cybersecurity Dive that its working hypothesis was an AI agent using scripted tools with occasional human intervention. Huntress saw indicators including scripted user agents and a ConnectWise application granting itself global administrator privileges inside a customer environment. That supports the agent-driven assessment, without establishing that every step was autonomous.

Service recovery does not finish the cleanup

ConnectWise confirmed unauthorized access to Cloud Backup application credentials. In its October 22 update at 13:00 UTC, the company said phased restoration was advancing, with security validation required at each step. It had previously said restoration would take several days. Availability and reconnection instructions will be supplied service by service, rather than through a blanket reopening.

ConnectWise's instructions for affected partners

• Keep affected application connections disabled until formal instructions apply to your service.
• Review your own and managed customers’ Microsoft 365 environments for unauthorized changes or persistent access.
• Use the technical investigation and remediation guide and webinars covering sign-in logs, application registrations, credentials and permissions.

ConnectWise says existing backup archives remain encrypted, isolated and preserved, with no indication of compromise. It also reports no indication that other ConnectWise offerings were affected. Those findings do not settle whether individual customer environments were compromised: containing the affected connections does not remove unauthorized access already established inside them.