Chinese Hackers Use AI to Breach ConnectWise, Targeting 2,250 Microsoft 365 Tenants

• •Storm-0940 compromised over 2,250 Microsoft 365 tenants using the ARTEX AI framework.
• •The attack achieved privileged access in under three hours, bypassing MFA through pre-authorized applications.
• •ConnectWise has disabled affected services and is restoring them while advising customers to check for unauthorized access.

A Chinese state-aligned hacking group known as Storm-0940 exploited the ConnectWise Cloud Backup service to compromise over 2,250 Microsoft 365 tenants. Utilizing the ARTEX AI penetration testing framework, the attackers automated their operations, achieving privileged access in under three hours in some cases. The campaign, which began in September 2026, involved rapid sign-in attempts reaching 2,900 per minute, allowing the group to bypass multi-factor authentication by leveraging pre-authorized applications. Microsoft confirmed that the attack targeted various sectors, including defense, finance, and technology. ConnectWise has since disabled affected services and is in the process of restoring them, while advising customers to review their logs for unauthorized access. The incident highlights the growing threat of AI-driven cyberattacks and the vulnerabilities within third-party application integrations.