Microsoft links china-linked cyber group to supply-chain attack on ConnectWise

Microsoft has attributed a recent supply-chain attack on ConnectWise customers to a China-state aligned threat group known as Storm-0940. The attack targeted Microsoft 365 environments, with the group using an AI-driven penetration testing framework called ARTEX to automate attacks. The campaign, which began as early as September 2026, involved a password-spraying campaign that targeted 327 Microsoft 365 and Exchange Online accounts across eight organizations, resulting in over 151,000 failed logon attempts. Storm-0940 then compromised ConnectWise’s Cloud Backup service, using AI agents and malicious infrastructure to access multiple customer environments. Microsoft noted that the threat group used ARTEX to reach over 2,250 tenants at 2,900 sign-in attempts per minute. ConnectWise temporarily shut down services following the attacks and is now restoring them in phases. Igor Tsyganskiy, Microsoft’s executive vice president, highlighted the ongoing wave of AI-driven cyberattacks, noting the ConnectWise incident as one of many.