ConnectWise Cloud Backup Compromised in Attack Targeting Hundreds

What changed

Microsoft says the China state-aligned group Storm-0940 used the AI-enabled ARTEX penetration-testing framework to compromise ConnectWise Cloud Backup in a campaign aimed at hundreds of organisations worldwide.

ConnectWise contained the affected application connections and began restoring services in controlled phases. But individual customer tenants require separate review because unauthorised access may already have been established inside them.

Why it matters

The striking part is not simply that hackers used AI. It is that ARTEX can automate reconnaissance and data-exfiltration tasks, while Storm-0940 reportedly gained privileged cloud persistence at multiple organisations in a short period. That means access could survive initial cleanup and remain a problem inside customer environments.

The targets spanned aerospace, defence, energy, finance, government, manufacturing, media, semiconductors, software and technology. Most attempts failed, Microsoft said, but the successful ones reached organisations through a shared IT service, turning one compromised provider into a potential doorway across many tenants.

ConnectWise is restoring services gradually, while customers must determine separately whether their own environments were accessed. The Chinese Embassy in Washington rejected allegations of state-linked hacking. The immediate question is therefore narrower and more practical: which customer accounts, if any, retained unauthorised access after ConnectWise contained the affected connections?