Microsoft: Storm-0940 used AI agents in ConnectWise breach

Microsoft says a China-aligned hacking group known as Storm-0940 used AI agents to break into ConnectWise's Cloud Backup service and then reach customers' Microsoft 365 accounts. Microsoft Threat Intelligence published its findings on October 21, five days after ConnectWise disclosed the breach in a security advisory and security firm Huntress released its first account of the attack, as The Next Web reports.

How the attack worked

ConnectWise Cloud Backup, formerly SkyKick, lets IT service providers back up their clients' Microsoft 365 data. It relies on applications with broad access to customer accounts, which makes those app identities an attractive way in. Microsoft says Storm-0940 compromised several of them, used them to enter customer accounts and in some cases added new authentication keys and changed administrator roles to stay inside.

The group used ARTEX, a free open-source tool built around AI agents that can run on different models. Security teams can also use such tools to test their own defences. According to Microsoft, the agents scanned networks, tried to guess passwords and exploited application permissions with limited human involvement. Microsoft did not name the AI model involved.

Storm-0940 tried to sign in to more than 2,250 Microsoft 365 tenants, at up to 2,900 attempts per minute. Most attempts failed, but in some cases the group obtained high-level cloud access within three hours. Microsoft says the group has been active since 2021 and has targeted defence, government, law, energy and semiconductor organisations.

Impact and response

Huntress had confirmed breaches at 162 tenants by October 16. It later found nearly 1,000 tenants that received sign-in attempts, with more than 300 successful. ConnectWise disabled seven application identities on October 17 and took Cloud Backup offline. It has not publicly responded to Microsoft's attribution, and a spokesperson told The Record there was no indication backup data had been compromised.

Microsoft stresses the incident did not stem from a vulnerability in its own systems. It advises customers to keep ConnectWise integrations disabled until the company confirms they are safe to restore, and to review sign-in logs back to at least October 15. ConnectWise began restoring the service in stages on October 21 and expects recovery to take several days.