2,250 Customers Targeted Through One Backup Provider's Trusted Access

A China-state-aligned hacking group used AI agents to accelerate attacks through breached ConnectWise applications, Microsoft says, exploiting a software provider's trusted access to reach its customers. ^[1]

Microsoft attributed the supply-chain compromise to Storm-0940, a group it says has been active since 2021. Its October 21 investigation described attempted sign-ins to more than 2,250 Microsoft 365 customer environments, reaching a peak of 2,900 attempts per minute. ^[1]

ConnectWise, which provides software for IT management and services, confirmed unauthorised access to application credentials associated with Cloud Backup, formerly known as SkyKick. The company said Microsoft's attribution appeared consistent with evidence it had reviewed. Service restoration and the investigation are continuing. ^[4]

The route into customers was the access they had already granted their backup provider. Microsoft says the attackers gained control of identities used by multiple ConnectWise cloud applications, then used those applications' existing permissions to authenticate to customer environments. In several, Microsoft observed reconnaissance, application credential changes and attempts to alter privileges. ^[1]

The 2,250 figure measures environments targeted by attempted sign-ins, not confirmed breaches. Microsoft has not given a count of customers whose data was stolen and says that an affected application, or even successful authentication, does not itself establish data access or theft. The initial method used to obtain the ConnectWise credentials and the division of work between human operators and AI agents are not yet established. ^[1][3]

The access was already approved

Cloud backup applications need permission to work with the information they protect. In this incident, those application identities became the route from a compromised supplier into downstream Microsoft 365 environments, according to Microsoft. The attackers could use access that customers had already approved rather than depend solely on persuading individual users to enter passwords. ^[1]

That makes the application credentials central to the incident. A supplier's access can serve many customers, so losing control of it creates a problem that extends beyond the supplier's own systems. Microsoft's account describes intruders using the same IP address range to authenticate through multiple ConnectWise applications after gaining control of their identities. ^[1]

The activity inside customer environments went beyond checking whether a sign-in worked. Microsoft observed follow-on use of Microsoft Graph, the interface through which software can interact with Microsoft 365 services. That included examining environments, changing application credentials and attempting to modify privileges, steps that could support continued access. ^[1]

For defenders, the practical consequence is that containing the supplier's breach and checking each customer's environment are separate jobs. Disabling an affected connection can close a route in. It does not determine what someone did while that route was open.

ConnectWise is telling customers to keep affected connections disabled until they receive formal reconnection instructions. It also says individual Microsoft 365 environments require their own review. The company has contained affected application connections and is restoring service in controlled phases. ^[4]

AI shortened the work

Microsoft says Storm-0940 used ARTEX, an open-source penetration-testing framework that can work with different AI models. Penetration testing is authorised probing for security weaknesses. Microsoft describes ARTEX as a system of AI agents capable of automating tasks from reconnaissance through data extraction with little human interaction. ^[1]

In this operation, Microsoft says the framework accelerated scanning, reconnaissance, password spraying and abuse of ConnectWise application access. Password spraying means trying passwords across numerous accounts, looking for one that works. These are established attack techniques, with software agents speeding up the work. ^[1]

Microsoft's broader investigation found that some ARTEX-driven attacks reached privileged cloud access in less than three hours. It also said most targeting was unsuccessful, while Storm-0940 secured privileged access that could persist at many organisations within a short period. ^[1][2]

The speed matters because investigation takes time. Defenders must identify the affected identity, establish its permissions and revoke access while checking for changes already made. Automating the attacker's sequence compresses the time available for those decisions.

The unsuccessful attempts offer a useful measure of both the volume and the limits of the operation. From October 10 to 14, Microsoft says Storm-0940 infrastructure targeted 327 accounts across eight organisations in a password-spraying campaign. It recorded more than 151,000 failed logons, including more than 111,000 on October 11. ^[1][3]

Microsoft observed no successful authentication or issuance of access tokens, digital keys that prove a login is genuine. It also saw no Microsoft Graph calls or directory changes during that campaign. A very large number of attempts can still produce no foothold. ^[1][3]

ARTEX's developer had publicly acknowledged misuse of the tool on October 8, according to The Record. The developer said on GitHub that the project, originally intended for authorised security testing, would no longer be updated and would become closed source. ^[2]

Restoration does not finish the investigation

ConnectWise says its existing backup archives remain encrypted, isolated and preserved, with no indication that they were compromised. It also says it has no indication that other ConnectWise products or services were affected. Those are the company's current findings as its investigation continues. ^[4]

Microsoft, for its part, says the activity did not result from a compromise of, or vulnerability in, its own corporate systems, products or services. Its account places the route through the ConnectWise applications and their previously authorised access. ^[1]

The immediate work now falls to ConnectWise and its customers: restoring connections in stages while separately reviewing the environments those connections could reach. Reconnection instructions matter because bringing a service back online and establishing that an individual customer's environment is secure are different decisions. ^[4]

ConnectWise said on October 22 that it would issue another update by October 23 at 01:00 UTC. ^[4]