Skip to content
China-linked Storm-0940 Breaches ConnectWise Backup Service Using AI Tool

China-linked Storm-0940 Breaches ConnectWise Backup Service Using AI Tool

First seen 21 Oct 2026, 22:10 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 07:39 UTC
  • •Storm-0940 exploited ConnectWise's Cloud Backup service using the ARTEX AI tool.
  • •The attack targeted hundreds of organizations, achieving privileged access in many cases.
  • •ConnectWise has suspended its Cloud Backup service and is restoring affected accounts.

China-aligned hacker group Storm-0940 compromised ConnectWise's Cloud Backup service, targeting hundreds of organizations globally. Utilizing the AI-driven penetration testing framework ARTEX, the group automated attacks that achieved privileged access in many cases. Microsoft reported that the attack began in September 2026, with Storm-0940 executing over 2,250 tenant logins at a rate of 2,900 attempts per minute. While many attack attempts were unsuccessful, the hackers established persistent access to cloud environments across various sectors, including defense and finance. ConnectWise has since suspended its Cloud Backup service and is in the process of restoring affected accounts. The incident highlights the risks associated with third-party technology providers and the potential for widespread impact from a single compromised credential.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-09-01
Storm-0940 begins targeting organizations
The group initiated a series of automated attacks using ARTEX, affecting multiple sectors.
Microsoft
2026-10-14
ConnectWise Cloud Backup compromised
Storm-0940 successfully logged into customer systems, leading to unauthorized access.
Insurancebusinessonline.Au
2026-10-17
ConnectWise suspends Cloud Backup service
The service was shut down to contain the breach, with a full reset of accounts initiated.
Insurancebusinessonline.Au
2026-10-19
Account reset completed
ConnectWise completed a full reset of all accounts and credentials in the affected environment.
Insurancebusinessonline.Au

More articles in this cluster (8)

Following this threat?

Track Storm-0940 and ConnectWise in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (26)

1 / 3

Common questions

Which organizations are affected?
Organizations across various sectors, including defense, finance, and government, were targeted.
What should ConnectWise customers do?
Customers should monitor their systems for unauthorized access and follow ConnectWise's guidance on restoring services.
How did the hackers gain access?
The hackers used stolen credentials and the ARTEX AI tool to automate attacks on ConnectWise's Cloud Backup service.