Microsoft Ties ConnectWise Cloud Backup Breach to China-Aligned Hackers Using AI Tool

Microsoft said Wednesday that a China state-aligned hacking group it calls Storm-0940 carried out the recent supply chain compromise of ConnectWise Cloud Backup, using an AI-driven penetration testing tool to automate attacks against hundreds of organizations worldwide.

The tool, a Go-based framework known as ARTEX, was used to speed up scanning and reconnaissance, password spraying and abuse of OAuth applications - the permission links that let apps access cloud accounts - at downstream victims. Microsoft said the group operated at "machine speed," automating attacks across a wide range of sectors including aerospace, energy, financial services and government since September 2026.

In the ConnectWise incident, the attackers used ARTEX to attempt sign-ins to more than 2,250 tenants at up to 2,900 attempts per minute, Microsoft said. Between October 10 and 14, 2026, infrastructure at 144.172.64[.]99 ran an automated cross-tenant password-spray campaign against 327 accounts at eight organizations, producing over 151,000 failed logon events and peaking at more than 111,000 failures in a single day. No successful authentication or directory change was detected in that window.

That changed on October 15, 2026, when the AI agents gained access to the identities of multiple ConnectWise cloud applications and began using them to authenticate to customer environments, relying on trust the apps already held within tenants. In some cases the agents moved beyond authentication into Microsoft Graph and directory operations, including reconnaissance, credential changes to establish persistence, and modifications involving identities, groups and privileged roles. Microsoft said such changes can remain active as a backdoor even after the original compromised application is remediated.

Microsoft first detailed Storm-0940 in November 2024, linking it to a botnet called Quad7 used for evasive password-spray attacks, and assesses the group has been active since at least 2021. The tech giant said it has seen threat actors in multiple regions weaponize ARTEX.

Recorded Future's Insikt Group, which tracks the cluster behind attacks on South Korean financial institutions as TAG-217, traced related activity to August 17, 2026, when it tested infrastructure for remote access and conducted internet scanning. Zscaler ThreatLabz later reported that the campaign reached beyond South Korea, citing a custom ARTEX deployment whose prompt history included requests for bulk personal and transaction data and questions about selling stolen data, suggesting financial motives.

ConnectWise said the activity "describes a campaign that reaches well beyond any one company," warning that nation-state actors increasingly target the software supply chain because one trusted connection can open the door to many organizations. The company, which temporarily shut down services after the attacks, said it is restoring them in phases over several days.

Source: The Hackers News