Cyberattacks | Vulnerabilities

Hackers Turned ConnectWise Backup Access Into an AI-Driven Attack

Microsoft says a China-aligned group used an open-source AI hacking framework to target thousands of Microsoft 365 tenants via a backup vendor.

By Content Team

Oct 23, 2026

ON THIS PAGE

Microsoft has tied the attack on ConnectWise’s Cloud Backup service to Storm-0940, a hacking group it describes as China-state aligned. According to Microsoft, the group used ARTEX, an open-source AI penetration-testing framework, and compromised application credentials tied to the service to try to break into more than 2 250 downstream Microsoft 365 tenants. Most attempts failed, but in multiple cases the attackers gained privileged cloud access in under three hours.

ARTEX generated up to 2 900 sign-in attempts per minute, leaving defenders little time to respond. Microsoft says the attack was part of a broader Storm-0940 campaign, active since at least September, that targeted hundreds of organizations in industries including defense, energy, aerospace, and financial services. How the attackers first obtained the credentials remains undisclosed.

ConnectWise has suspended Cloud Backup and taken its SaaS Security and Cloud Management services offline, though it says existing backup archives show no sign of compromise. The company urges customers to keep affected connections offline until further notice, and Microsoft advises reviewing every linked Microsoft 365 tenant and preserving logs before making changes.

Source: Dark Reading

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?