Microsoft Says China State-Aligned Hackers Used AI to Breach ConnectWise and Target More Than 2,250 Cloud Tenants
A China state-aligned hacking group used an AI-powered offensive security framework to compromise ConnectWise Cloud Backup and rapidly target thousands of downstream cloud environments, according to Microsoft. The campaign, attributed by Microsoft to the threat actor Storm-0940, marks a dangerous escalation in the way China-linked cyber operators can combine supply-chain access with autonomous artificial intelligence to attack American companies, government organizations and critical industries at machine speed.
The most important part of this campaign is not simply that another China-linked hacking group targeted Western organizations. Microsoft says Storm-0940 used an open-source agentic penetration-testing framework called ARTEX to automate reconnaissance, password spraying, application abuse and post-compromise activity. In several cases, the attackers moved from initial targeting to privileged access inside a victim’s cloud environment in less than three hours.
That dramatically changes the defensive equation for American organizations.
Traditional cyber intrusions often give defenders some time to detect suspicious behavior, investigate alerts and cut off access before attackers fully establish themselves. AI-driven agents can compress that timeline. They can scan continuously, test multiple attack paths at once, change tactics automatically and continue working around the clock without the limits that slow human operators.
Microsoft says Storm-0940 has been active since 2021 and has historically targeted organizations across multiple industries for data theft. The group has used password spraying, exploitation of internet-facing systems and compromised accounts to gain access. Once inside cloud environments, it has also added credentials to existing OAuth applications, allowing continued access to Microsoft 365 resources and enabling the theft of email and other information through Microsoft Graph.
The ConnectWise incident gave the group something even more dangerous: trusted third-party application access.
According to Microsoft, Storm-0940 compromised ConnectWise Cloud Backup and then abused the identities of affected ConnectWise applications to authenticate into downstream customer environments. Because those applications had already been granted legitimate permissions by customers, the attackers could leverage existing trust instead of relying entirely on stolen employee passwords.
That supply-chain structure is what makes the incident especially threatening to the United States.
American companies depend heavily on third-party IT providers, cloud-backup vendors and managed-service software. Those providers often require powerful permissions to administer systems, back up data and integrate with Microsoft 365. If one trusted application is compromised, the attacker may gain a pathway into many customers at once.
Microsoft said the campaign targeted hundreds of organizations worldwide in sectors including aerospace and defense, automotive, chemicals, energy, financial services, government, legal services, manufacturing, media, the military, semiconductors, software, technology, think tanks and nonprofits.
These are not random low-value targets.
They include sectors that support U.S. defense production, energy infrastructure, financial stability, advanced technology and government operations. For a China state-aligned threat actor, access to those environments can provide intelligence, credentials, internal communications and opportunities for longer-term persistence.
The scale of the automated activity is especially alarming.
Microsoft observed Storm-0940 using ARTEX to attempt sign-ins across more than 2,250 tenants. During one password-spraying campaign between October 10 and October 14, Microsoft recorded more than 151,000 failed login events against 327 accounts across eight organizations.
At the peak of the activity, the attackers generated roughly 2,900 failed authentication attempts per minute.
That speed matters because cybersecurity teams operate under time pressure. Even when automated security systems generate alerts, analysts still need to evaluate them, determine whether they represent a real threat, coordinate remediation and revoke access. An AI-driven attacker capable of launching thousands of attempts per minute can overwhelm that response window.
Microsoft said most of the targeting was unsuccessful. But Storm-0940 still achieved privileged cloud persistence at multiple organizations within a short period.
That is the more important fact.
Attackers do not need to compromise every target for a campaign to become strategically valuable. If automated agents can attack thousands of environments quickly and succeed against even a fraction of them, the economic advantage shifts toward the attacker.
This is one reason AI-powered cyber operations are particularly dangerous for the United States.
American networks are large, interconnected and heavily dependent on cloud software. Every major company may have dozens or hundreds of third-party applications with some level of access to corporate systems. Every application credential, service principal or OAuth integration creates another potential path into sensitive data.
Storm-0940 appears to have understood that architecture and used ARTEX to exploit it at scale.
Microsoft says the AI framework can conduct penetration-testing tasks ranging from reconnaissance to data exfiltration with minimal human involvement. ARTEX can use different AI models and coordinate multiple agents as part of one autonomous attack workflow.
In practical terms, that means a China state-aligned operator can give AI systems an objective and let them perform much of the repetitive technical work automatically.
The implications for American national security are serious.
China-linked cyber operations have long focused on stealing information, targeting government agencies, probing infrastructure and collecting intelligence from private companies. AI does not fundamentally change Beijing’s strategic interests, but it can dramatically increase the speed and scale at which those interests are pursued.
A threat actor that once needed teams of operators to investigate targets individually can increasingly use AI to automate reconnaissance across thousands of systems.
That reduces the marginal cost of each attack.
It also creates a dangerous asymmetry. A defender must protect every important identity, application, vendor connection and cloud permission. The attacker only needs one weakness.
Supply-chain attacks magnify that imbalance further because compromising one service provider may open pathways into dozens or hundreds of customer environments.
The ConnectWise incident demonstrates exactly why American companies cannot treat third-party applications as automatically trustworthy simply because they come from a legitimate vendor.
Trust can be hijacked.
Once Storm-0940 gained control of affected application identities, Microsoft observed activity involving Microsoft Graph, directory reconnaissance, credential modification and attempts to change privileges. In some cases, the attackers altered application credentials in ways that could allow continued access even after the original compromised application was removed or repaired.
That persistence is particularly dangerous.
A company may believe it has contained the original intrusion while a new credential, application identity or privileged role quietly preserves the attacker’s access. ConnectWise itself warned that restoring services does not automatically eliminate unauthorized access that may already have been established inside individual customer tenants.
That means affected organizations cannot simply wait for a vendor to fix the original application.
They have to investigate their own environments.
For American businesses, the lesson is clear: cloud identities are now part of the attack surface. Security teams must monitor service principals, OAuth applications, application credentials and privilege changes with the same seriousness traditionally applied to employee accounts.
The broader lesson is even more important.
China-aligned cyber operators are no longer limited to conventional hacking workflows. They are adopting autonomous AI to accelerate established techniques and turn them into industrial-scale operations.
That does not mean AI invented a new kind of espionage. It means AI makes familiar methods much faster.
Password spraying existed before ARTEX. OAuth abuse existed before ARTEX. Supply-chain attacks existed before ARTEX. What changed is that an AI framework can coordinate these activities continuously and at machine speed.
For a nation-state-aligned actor, that is a force multiplier.
The United States should expect this model to spread. Open-source agentic security tools can be used legitimately by defenders and penetration testers, but the same software can be adapted by hostile actors. As more AI frameworks become capable of autonomous reconnaissance, exploitation and persistence, the technical barrier to large-scale cyber operations will continue to fall.
American organizations should respond by reducing unnecessary application privileges, reviewing third-party integrations, rotating credentials after vendor incidents and monitoring anomalous service-principal activity in real time.
These are technical measures, but the strategic problem is larger.
The U.S.-China competition increasingly extends into cloud infrastructure, identity systems and artificial intelligence. Beijing does not need to destroy a network to benefit from access. Quiet persistence inside defense contractors, energy companies, semiconductor firms, financial institutions or government systems can provide intelligence value for months or years.
That is why Microsoft’s attribution matters.
This is not merely an anonymous criminal group using AI for profit. Microsoft identifies Storm-0940 as a China state-aligned actor with a history of targeting organizations for data theft.
That changes how the campaign should be understood.
A criminal hacker may seek credit-card numbers or ransom payments. A state-aligned actor can have strategic objectives: mapping networks, collecting communications, identifying decision-makers, stealing intellectual property and preserving access that could become useful during future political or military crises.
When those capabilities are combined with agentic AI, the risk grows.
The United States should therefore treat AI-enabled supply-chain compromise as a national-security problem, especially when it involves threat actors aligned with strategic competitors.
American companies also need to recognize that the weakest point in their security may belong to someone else.
A company can maintain strong internal controls and still be exposed through a cloud-backup provider, software vendor or managed-service application holding privileged permissions.
Storm-0940 exploited exactly that kind of trust relationship.
The incident offers a warning about the next phase of China-linked cyber operations. The goal is no longer simply to find one vulnerability and exploit it manually. AI allows hostile operators to probe entire ecosystems at once, search continuously for credentials and misconfigurations and use compromised applications to move quickly across cloud environments.
Speed is becoming a weapon.
For American defenders, the response has to be equally fast.
Cybersecurity programs designed around slow investigation cycles and manual review will struggle against AI-accelerated attackers operating thousands of times per minute. Companies need automated detection, rapid credential revocation, real-time privilege monitoring and strong visibility into every third-party application connected to their cloud environment.
The ConnectWise compromise should therefore be viewed as more than another cybersecurity incident.
It is evidence that China state-aligned operators are learning how to combine supply-chain compromise, trusted cloud identities and autonomous AI into a single scalable attack model.
That combination directly threatens the industries that underpin American economic and national security.
The United States cannot prevent adversaries from experimenting with AI. It can, however, make trusted access harder to abuse, reduce excessive permissions and force attackers to work much harder for every foothold.
That is becoming urgent.
Storm-0940 has shown what happens when a China state-aligned actor gains access to a trusted application and then gives AI agents the ability to exploit that access at machine speed.
For American organizations, the warning is already here.
