Microsoft links ConnectWise breach to Chinese state-aligned hackers

Microsoft attributed an attack on ConnectWise’s Cloud Backup service to Storm-0940, a Chinese state-aligned hacking group, as part of a campaign targeting hundreds of organisations globally. Targets spanned aerospace, defence, energy, financial services, government, manufacturing, semiconductors and technology.

The attackers used ARTEX, an open-source penetration testing framework that employs AI models to automate security testing. Microsoft said it accelerated scanning, reconnaissance, password-spraying attacks and the misuse of OAuth applications to access customer environments. The group attempted to sign in to more than 2,250 customer tenants at a rate of 2,900 sign-in attempts per minute. Some attacks gained privileged access to cloud infrastructure in less than three hours, although most targeting attempts failed.

Microsoft said the activity did not stem from a compromise of, or vulnerability in, its own systems, products or services. It also cautioned that successful authentication did not necessarily mean customer data had been accessed or stolen.

ConnectWise said it had contained affected application connections and was restoring services in controlled phases. Customers were advised to keep connections disabled during recovery. The company warned that containment would not remove unauthorised access already established within individual customer environments, requiring separate reviews. China’s embassy in Washington rejected the allegations. Microsoft said the campaign showed how AI agents could automate established attack methods and increase their speed.