Microsoft blames a China-aligned group for the ConnectWise backup service hack

From October 10 to 14, a single IP address hammered 327 Microsoft 365 accounts across eight organizations, up to 2,900 times per minute at its peak on October 11. More than 151,000 attempts failed, with not one successful sign-in. By October 15 and 16, the indicators published on the ConnectWise hack pointed to the same address range, an overlap Microsoft noted.

On October 21, Microsoft Threat Intelligence published its analysis. It says the Storm-0940 group, which it describes as aligned with the Chinese state, is responsible for the compromise of ConnectWise Cloud Backup, the American vendor's Microsoft 365 backup service, disclosed in mid-October. Microsoft calls this an assessment, not a certainty. The group reportedly automated its attacks with ARTEX, an open-source penetration-testing tool that hands most of the work to AI agents.

A penetration-testing tool that works almost on its own

ARTEX is a multi-agent AI system written in Go that can run on top of any model. According to Microsoft, it automates a penetration test end to end, from reconnaissance to data exfiltration, with little human intervention. Several malicious groups use it. Microsoft mentions public reports of data thefts at South Korean banks, which we covered on October 11, without confirming them.

Storm-0940 reportedly used it starting in September 2026 to speed up every stage: scanning targets, mass password guessing, hijacking authorized applications. Hundreds of organizations worldwide were targeted, in aerospace, defense, energy, finance, government, law, manufacturing, media and semiconductors.

More than 2,250 customers targeted, some compromised in under three hours

The centerpiece is the stolen ConnectWise application credentials, as we reported on October 18. With them, the group tried to sign in to more than 2,250 Microsoft 365 environments. These applications open a session without any user having to sign in: once inside, the attackers explored directories, modified application credentials and changed roles and groups. In one case cited by Microsoft, a ConnectWise management application granted itself the Global Administrator role.

In several cases, less than three hours passed between the first targeting and privileged access. Most attempts failed, however. Microsoft does not say how many environments were actually compromised, and notes that a successful sign-in "does not necessarily mean" that data was accessed or stolen.

What to check if you used ConnectWise Cloud Backup

According to Microsoft, no vulnerability in its systems or products is involved here: the attackers used applications to which customers had themselves granted broad permissions. Microsoft's recommendations therefore focus on those permissions:

• keep ConnectWise application sign-ins disabled until the vendor publishes its official restoration guidance;
• do not delete the affected applications right away: first preserve their configuration and the evidence;
• look up applications by their ID, not by their display name;
• review "service principal" sign-ins (the applications' technical accounts) since October 15, and since October 1 if your logs allow it;
• check the Entra ID and Microsoft 365 audit logs for added credentials, new privileged roles, granted consents, and access to mailboxes and files;
• remove permissions that third-party applications do not need.

One question remains open: in how many of these environments did the attackers actually read emails or files? Neither Microsoft nor ConnectWise has said so far.