
Microsoft ties ConnectWise cloud backup breach to China-aligned hackers using AI tool
Stolen app credentials were used to try to reach more than 2,250 Microsoft 365 tenants; ConnectWise services remain disrupted
Microsoft's Oct. 21 threat report attributes the compromise of ConnectWise Cloud Backup, formerly SkyKick, to a group it calls Storm-0940 and describes as aligned with the Chinese state. Microsoft says the group used Artex, an open-source agentic penetration-testing framework, to automate password spraying and abuse of OAuth app permissions. It attempted sign-ins to more than 2,250 Microsoft 365 tenants and, in some cases, gained privileged cloud access in under three hours. Microsoft says most attempts failed and has not said how many customers were actually breached. ConnectWise disclosed the intrusion Oct. 16 and suspended Cloud Backup, SaaS Security and Cloud Management. It is restoring them in phases and has not explained how the credentials were obtained. It says stored backups remain encrypted and show no sign of compromise. Customers are told to keep the app connections disabled and check for attacker-created access. The attribution is Microsoft's assessment.
Why it mattersOne stolen vendor credential reached customers of many managed service providers at once, and restoring the service will not remove access attackers already set up.












