Storm-0940 Used ARTEX in ConnectWise Cloud Backup Attack
Microsoft said the China-aligned Storm-0940 group used the agentic ARTEX framework and stolen ConnectWise application credentials to target Microsoft 365 tenants after gaining unauthorized access to ConnectWise Cloud Backup. Storm-0940 attempted sign-ins against more than 2,250 tenants, while Huntress confirmed unauthorized sign-ins in 162 tenants and later found sign-in activity in nearly 1,000 Entra tenants, with more than 300 attempts succeeding. Most password-spraying attempts failed, and ConnectWise said it had no indication that backup data was compromised.
The incident shows how AI agents combined with stolen multi-tenant application credentials could automate reconnaissance and sign-in attempts at a scale and speed that security teams had limited time to detect and respond to.
Microsoft says a China-aligned hacking group used AI agents to breach ConnectWise’s Cloud Backup service, opening a route into customers’ Microsoft 365 accounts.
Microsoft Threat Intelligence published its findings on Storm-0940 on October 21. ConnectWise disclosed the breach in a security advisory on October 16, the same day security firm Huntress published its initial account of the attack.
ConnectWise Cloud Backup, previously known as SkyKick, allows IT service providers to back up clients’ Microsoft 365 data. The service relies on applications with broad access to customer accounts, making those app identities a potential route into connected systems.
#Microsoft#ConnectWise#ARTEX#Storm-0940#Microsoft 365#ConnectWise Cloud Backup#Huntress