Microsoft Links ConnectWise Cyberattack to Chinese State-Aligned Hackers

Microsoft has linked a major cybersecurity incident involving IT services provider ConnectWise to a Chinese state-aligned hacking group known as Storm-0940. The findings, published on October 21, 2026, indicate that the attackers exploited application credentials associated with ConnectWise Cloud Backup as part of a wider campaign targeting organisations across multiple industries. According to Microsoft, the operation affected businesses and institutions in sectors including government, financial services, energy, aerospace, defence, manufacturing, technology and semiconductors. ConnectWise confirmed that it had identified unauthorised access to application credentials and launched an investigation. The incident has raised concerns about supply-chain attacks, in which compromising one technology provider can create security risks for many of its customers.

A significant aspect of the attack was the reported use of ARTEX, an open-source, AI-driven penetration-testing framework. Microsoft said the tool can automate several stages of cyber operations, including reconnaissance, testing security weaknesses and data exfiltration. Although penetration-testing frameworks have legitimate uses in authorised security assessments, their automation capabilities can also be misused by malicious actors. Microsoft reported that the attackers used AI-assisted techniques to accelerate their operations against numerous organisations. TechCrunch subsequently reported that the activity involved approximately 2,250 organisations and nearly 3,000 attempted sign-ins per minute. Such speed can make detection and response more difficult for security teams, particularly when attackers exploit legitimate application identities rather than relying solely on conventional malware.

The attackers reportedly took advantage of application credentials associated with ConnectWise Cloud Backup, formerly known as SkyKick Cloud Backup. These credentials enabled connections between ConnectWise’s service and customers’ Microsoft 365 environments. By abusing the application’s existing permissions, attackers could potentially access customer environments without needing to compromise each user’s password individually. Security researchers reported suspicious authentication activity and attempts to establish persistent access, including unauthorised changes to application permissions in some environments. Microsoft said the campaign achieved privileged cloud access at a number of organisations, meaning attackers could potentially retain elevated access even after initial remediation. However, the full extent of data accessed or stolen has not been established publicly, and individual customer environments require separate investigations.

ConnectWise responded by disabling affected application connections and suspending its Cloud Backup service while its investigation and remediation work continued. The company also temporarily suspended its SaaS Security and Cloud Management services as a precaution. In updates published on October 22, ConnectWise said restoration would take place in stages, subject to security validation. It stated that existing backup archives remained encrypted, isolated and preserved, with no indication that those stored archives had been compromised. However, the company warned that this did not establish whether individual customers’ live Microsoft 365 environments had been affected. Administrators were advised to review sign-in records, application credentials, permissions and other indicators of unauthorised activity across their own environments and those of customers they manage.

The incident highlights the growing security implications of AI-assisted cyber operations and the risks associated with granting third-party applications broad access to corporate systems. AI tools can help legitimate security professionals identify vulnerabilities more efficiently, but similar capabilities may also allow attackers to scale reconnaissance and exploitation attempts. Microsoft attributed the campaign to a Chinese state-aligned group, while the Chinese government has rejected allegations of state-sponsored hacking and described politically motivated accusations as unacceptable. As investigations continue, affected organisations face the task of determining whether attackers accessed sensitive information or established persistent access before the compromised connections were disabled. The case also reinforces the importance of limiting application permissions, monitoring unusual authentication activity and reviewing third-party access regularly. Although disabling compromised connections can prevent further access through those connections, it does not automatically remove any unauthorised permissions or credentials already established inside a customer’s environment.