Microsoft has attributed a supply-chain campaign through ConnectWise Cloud Backup to Storm-0940, which it describes as a Chinese government-aligned group focused on data theft and active since 2021. The service the attackers abused is designed to protect Microsoft 365 and Google Workspace data. With stolen Cloud Backup credentials, they gained broad access to environments where the app was installed. ConnectWise shut down several services over a weekend after warnings from Microsoft and other security firms.

According to Microsoft, the campaign began in September and targeted hundreds of organizations worldwide. Most attempts failed, but the group breached organizations in government, aerospace, defense, finance, manufacturing, technology and energy. Microsoft saw about 2,900 sign-in attempts per minute, which it described as broad, low-rate password spraying combined with heavy, sustained attempts against selected identities. Microsoft tied the activity to Storm-0940 by matching IP addresses ConnectWise reported with addresses from its own investigations.

The tooling is what sets this campaign apart. Microsoft says Storm-0940 used ARTEX, an open-source penetration-testing framework released on GitHub earlier this year that coordinates teams of AI agents to automate offensive work. The group used it to speed up reconnaissance, credential theft and privilege escalation, reaching privileged access in several cases less than three hours after initial targeting. “Agents are not constrained by factors affecting humans,” Microsoft wrote, adding that such tools let attackers “scale their operations exponentially.” The ARTEX developer has since said the tool was misused and will go closed source. China’s Foreign Ministry denied knowledge of the incidents.

Why it matters / what to do

This campaign combines two things CISOs already worry about: SaaS-to-SaaS supply-chain access and attacks run at machine speed by AI agents. Defenses that depend on an analyst responding within hours fall behind when attackers reach privileged access that fast.

  • Audit OAuth apps and service principals with broad Microsoft 365 or Google Workspace permissions, starting with backup, archiving and security tools. Remove access that isn’t needed.
  • Rotate credentials tied to ConnectWise Cloud Backup if you used it, and review sign-in logs since September for spraying patterns and lockout spikes.
  • Automate first response. Conditional access, impossible-travel blocking and automatic token revocation now matter more than detection alone.

Source: The Record (Oct. 22, 2026)