Microsoft ties ConnectWise supply-chain attack to China-aligned Storm-0940

Microsoft attributed the ConnectWise supply-chain attack to a China-state-aligned group it tracks as Storm-0940. The hackers used the AI penetration-testing framework ARTEX to automate attacks, logging over 151,000 failed sign-ins in four days before compromising ConnectWise Cloud Backup customers' Microsoft 365 environments.

• Storm-0940 has been active since 2021, targeting sectors from aerospace to finance
• In four days before the breach: 151,000 failed logins, up to 2,900 per minute
• ARTEX automated reconnaissance, password spraying and OAuth abuse
• ConnectWise began phased service restoration on Wednesday