---
title: Hackers Turned ConnectWise Backup Access Into an AI-Driven Attack
description: Microsoft says a China-aligned group used an open-source AI hacking framework to target thousands of Microsoft 365 tenants via a backup vendor.
canonical_url: https://codekeeper.co/ticker/china-hackers-use-ai-tool-to-breach-companies
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks) | [Vulnerabilities](https://codekeeper.co/ticker/tag/vulnerabilities)

# Hackers Turned ConnectWise Backup Access Into an AI-Driven Attack

Microsoft says a China-aligned group used an open-source AI hacking framework to target thousands of Microsoft 365 tenants via a backup vendor.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Oct 23, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchina-hackers-use-ai-tool-to-breach-companies%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchina-hackers-use-ai-tool-to-breach-companies%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchina-hackers-use-ai-tool-to-breach-companies%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchina-hackers-use-ai-tool-to-breach-companies%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchina-hackers-use-ai-tool-to-breach-companies%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchina-hackers-use-ai-tool-to-breach-companies%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Microsoft has tied the attack on ConnectWise’s Cloud Backup service to Storm-0940, a hacking group it describes as China-state aligned. According to Microsoft, the group used ARTEX, an open-source AI penetration-testing framework, and compromised application credentials tied to the service to try to break into more than 2 250 downstream Microsoft 365 tenants. Most attempts failed, but in multiple cases the attackers gained privileged cloud access in under three hours. ARTEX generated up to 2 900 sign-in attempts per minute, leaving defenders little time to respond. Microsoft says the attack was part of a broader Storm-0940 campaign, active since at least September, that targeted hundreds of organizations in industries including defense, energy, aerospace, and financial services. How the attackers first obtained the credentials remains undisclosed. ConnectWise has suspended Cloud Backup and taken its SaaS Security and Cloud Management services offline, though it says existing backup archives show no sign of compromise. The company urges customers to keep affected connections offline until further notice, and Microsoft advises reviewing every linked Microsoft 365 tenant and preserving logs before making changes. Source: [Dark Reading](https://www.darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchina-hackers-use-ai-tool-to-breach-companies%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchina-hackers-use-ai-tool-to-breach-companies%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchina-hackers-use-ai-tool-to-breach-companies%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchina-hackers-use-ai-tool-to-breach-companies%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchina-hackers-use-ai-tool-to-breach-companies%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchina-hackers-use-ai-tool-to-breach-companies%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks AI-Powered Attacks Are Actively Targeting U.S. Critical Infrastructure, Agencies Warn Aug 20, 2026](https://codekeeper.co/ticker/ai-scripts-threaten-critical-infrastructure)

[Cyberattacks Hackers Hit Three UK Airports, Stealing Data from 8.7 Million Customers Aug 31, 2026](https://codekeeper.co/ticker/mag-cyberattack-exposes-customer-data)

[CrowdSec Source Code Stolen in TanStack Supply Chain Attack Sep 26, 2026](https://codekeeper.co/ticker/crowdsec-supply-chain-breach-github-repositories)

[Critical N-Central Flaw Gives Hackers Full Admin Access to MSP Platforms Aug 11, 2026](https://codekeeper.co/ticker/critical-n-central-rmm-vulnerability-cve-2026-18577)