78,207 exposed ConnectWise Automate consoles are unrelated to Cloud Backup attack

A ZoomEye search found 78,207 internet-reachable ConnectWise Automate instances, but this exposure surface is separate from the Storm-0940 attack on the hosted Cloud Backup service. Microsoft attributed the supply-chain compromise to the group, which used the ARTEX agentic AI framework to reach Microsoft 365 tenants.

• ZoomEye counted 78,207 exposed ConnectWise Automate consoles on 22 October 2026
• The attack ran through the hosted Cloud Backup service, not internet-facing RMM consoles
• Storm-0940 used the ARTEX AI framework to operate in Microsoft Graph and directories
• ConnectWise shut down services and restored them in phases, advising customers to keep connections disabled