Chinese hackers used AI agents to hit 2,250 organizations through ConnectWise backup breach

What happened

Researchers at Microsoft say a hacking group aligned with the Chinese state compromised ConnectWise's hosted backup product and made off with the application credentials that connect the service to its corporate customers' environments, TechCrunch reports. Customers use the product, Cloud Backup, to safeguard company data — which is exactly why it held powerful, standing access to their Microsoft 365 tenants.

With those credentials, the attackers could authenticate to a victim's Microsoft-hosted environment the way a legitimate integration would, exposing email and other files. Microsoft puts the number of organizations hit at roughly 2,250, with sign-in attempts running at close to 3,000 per minute — a pace that leaves security teams almost no time to notice and react.

Microsoft attributes the campaign to a cluster it tracks as Storm-0940, according to an independent analysis published on dev.to that builds on Microsoft's security blog and CyberScoop reporting.

Machine-speed attacks with ARTEX

TechCrunch attributes the throughput to ARTEX, an open-source framework that uses AI models for automated security testing. The same tooling was reportedly behind a recent breach of South Korean financial systems, where many targets ran weak configurations and had no multi-factor authentication in place.

The dev.to analysis, citing Microsoft, adds that in some victims' environments the AI agents did more than sign in. They progressed into Microsoft Graph and directory operations: reconnaissance, modifications to application credentials to maintain persistence, and changes touching identities, groups and privileged roles.

One detail reframes how the incident should be read. According to the analysis, none of the malicious traffic touched an internet-facing ConnectWise appliance. The compromised component was a multi-tenant hosted service, and the attackers' relationship to it was that of a customer rather than a network intruder — so the exposure of on-premises ConnectWise consoles says nothing about whether an organization was in scope for this campaign.

ConnectWise response and customer recovery

ConnectWise has suspended access to the cloud backup system while it investigates, and as of Thursday it was working on restoring the service, the company told TechCrunch.

The dev.to analysis fills in the timeline: ConnectWise took the affected services offline on the Saturday after the attacks and began a phased restoration the following Wednesday, telling customers to leave their connections switched off and warning that recovery would take several days.

For affected organizations, the analysis recommends a strict order of operations: rotate every credential reachable from the tenant while connections stay off, review directory changes made during the intrusion window, and only then re-enable integrations one at a time, re-checking each permission scope.

Uncertainty over the scope

The two accounts diverge on one important point. TechCrunch reports that about 2,250 organizations were hacked, but the dev.to analysis notes that neither Microsoft nor ConnectWise has said how many tenants were ultimately compromised. Microsoft has drawn a line between successful authentication and actual data access — signing in does not by itself prove that mailboxes or files were read or stolen.

Why it matters

The incident shows how supply-chain risk has shifted. There was no exploit aimed at customer infrastructure; the attackers abused a trusted third-party application that already held high privileges inside each victim's tenant. As the dev.to analysis notes, Microsoft itself flagged that a compromised third-party application with elevated permissions can reach far beyond its intended purpose — and a hijacked backup integration and a seized RMM console both end at the same place: a broad-reach identity that signs in without a human present.

It also marks a change in tempo. Intrusion at nearly 3,000 sign-in attempts per minute cannot be answered with manual monitoring, and a Microsoft executive vice president described this campaign as one in a wave of AI-powered attacks underway since the start of October.

Finally, the persistence techniques matter for every tenant running third-party integrations with directory permissions: a new secret added to an existing application, or a quiet change to a privileged role or group, is easy to miss. Inventorying those applications, baselining their configuration and alerting on changes is now baseline hygiene rather than extra credit.