Executive Summary
Microsoft has attributed a significant supply chain compromise of ConnectWise Cloud Backup to Storm-0940, a China state-aligned threat group active since 2021. The operation, which peaked in October 2026, targeted over 2,250 Microsoft 365 tenants across highly sensitive sectors including defense, aerospace, and energy. The primary impact was a multi-day service outage for ConnectWise customers and the potential exposure of cloud backup data.
Technically, the campaign is notable for the use of ARTEX, an 'agentic AI' penetration testing framework. This tool automated three critical phases: reconnaissance, high-velocity password spraying, and subsequent OAuth abuse. Between October 10 and 14, the group generated over 151,000 failed logons, averaging 2,900 attempts per minute at its peak. These sprays facilitated the breach of ConnectWise's backup infrastructure on October 15.
This incident highlights the increasing use of AI-driven automation by state-aligned actors to scale credential attacks against managed service providers (MSPs). Organizations relying on third-party cloud backup services must verify the integrity of their OAuth grants and monitor for anomalous high-frequency authentication failures that signal AI-augmented brute force activity.