Most companies never think about the backup app quietly copying their emails every night. That is exactly why hackers went after it. A China-linked group broke into a cloud backup service run by IT giant ConnectWise and used it as a master key into the Microsoft 365 accounts of other businesses. And this time, they had AI agents doing much of the legwork.
Here is the short version. Microsoft said on October 21 that a China state-aligned group it tracks as Storm-0940 compromised ConnectWise Cloud Backup between roughly October 15 and 17. The attackers stole the credential the app uses to connect to customers’ Microsoft 365 tenants, then fired off sign-in attempts against more than 2,250 organisations at nearly 3,000 attempts a minute. ConnectWise has switched the service off while it investigates.
Quick Facts
- Who: Storm-0940, a China state-aligned hacking group (per Microsoft), and IT management firm ConnectWise
- What: Stolen app credentials from ConnectWise Cloud Backup used to log in to customers’ Microsoft 365 environments
- When: Activity between October 15 and 17, 2026; Microsoft report published October 21
- Where: Organisations worldwide, including managed service providers, law firms and some critical infrastructure operators
- Key number: More than 2,250 Microsoft 365 tenants targeted, at about 2,900 sign-in attempts per minute
What Happened in the ConnectWise Breach
ConnectWise sells software that IT service firms, known as managed service providers or MSPs, use to look after their clients’ computers and cloud accounts. One of those products is Cloud Backup, the tool formerly called SkyKick, which ConnectWise bought in 2024. It backs up email, files and Microsoft Teams data.
To do that job, the backup app needs permission to read a customer’s Microsoft 365 data. It holds its own credential for this. The hackers got into ConnectWise’s cloud backup service and took that credential.
The scary part is how clean the entry looked. Because the attackers signed in as the trusted app itself, there was no user password to guess and no two-factor prompt to dodge. To Microsoft’s systems, it looked like the backup tool doing its normal rounds. That also means there is no simple software patch for this. It was not a bug. It was a stolen key.
How AI Hacking Agents Sped Up the Attack
Microsoft linked the speed of the campaign to ARTEX, an open-source framework that pairs with AI models and was built to stress-test security defences. Think of it as a toolkit that lets AI agents handle scouting, credential attacks and data grabbing with very little human hand-holding. Humans still picked the targets, according to reports.
The result was a pace no human team could match. Microsoft said the volume left defenders “little time to detect and respond.” In some cases the attackers went from first contact to privileged access in under three hours. The same ARTEX tool was recently tied to attacks on South Korean financial firms, according to research from CrowdStrike.
Security firm Huntress, which first spotted the activity, confirmed unauthorised sign-ins at 162 tenants by October 16. It also saw nearly 1,000 tenants receive attempts from the attackers’ servers, with more than 300 showing a successful login. Reuters described the campaign as hitting hundreds of organisations, so the final count of real victims is still being worked out.
Why This Supply Chain Attack Matters
Hacking one big company is bad. Hacking the vendor that thousands of companies trust is far worse. One stolen credential at ConnectWise opened doors at law firms, IT providers and groups linked to national security and trade, as per reporting cited by Startup Fortune.
Timing makes it sharper. Just a day after the news broke, billionaire investor Mark Cuban told a Reuters event in Nashville that AI hacking agents behave a bit like cockroaches: send enough of them and one finds a way in. His point was that AI mostly amplifies old brute-force tricks rather than inventing new ones, and that defenders can fight back with AI too. The ConnectWise case looks like a real-world example of that sheer-volume approach.
Is India Affected?
No Indian victims have been publicly named so far. But the lesson travels well. Lakhs of Indian businesses, from small CA firms to large exporters, run on Microsoft 365 and hand IT management to outside service providers. Many of those providers plug in backup, monitoring and security apps that get wide access and then are forgotten about.
India’s own IT services giants also manage cloud environments for clients around the world. Any company in that chain should treat this as a prompt to audit which third-party apps can reach its email and files.
What We Don’t Know Yet
- The exact number of organisations whose data was actually taken, as figures differ between Microsoft, Huntress and Reuters
- How the attackers first got into ConnectWise’s cloud backup service
- When Cloud Backup will be back online; scheduled backups and restores are unavailable for now
- Whether any India-based companies were among the targets
What This Means for You: Steps to Take Now
- Ask your IT provider directly whether ConnectWise Cloud Backup, Cloud Management or SaaS Security was connected to your Microsoft 365 account.
- Pull sign-in logs for October 15 to 17 and look for unusual app logins.
- Review third-party app permissions in Microsoft 365 and remove anything you no longer use.
- Check ConnectWise’s advisory page and run the indicators of compromise Huntress has shared against your audit logs.
- Keep a second backup of critical mail and files, since Cloud Backup restores are paused.
Microsoft’s full technical write-up is on its security blog, and ConnectWise posts updates on its trust advisories page.
Our Take
Everyone has spent two years asking whether AI will invent some brand-new super-hack. This breach suggests the real threat is more boring and more dangerous: AI doing old tricks at machine speed, through the trusted apps nobody checks. Two-factor login did nothing here. The fix is unglamorous housekeeping, knowing exactly which apps hold the keys to your data, and doing it before the next agent comes knocking.
FAQs
What is the ConnectWise breach?
China-linked hackers broke into ConnectWise’s Cloud Backup service, stole the app’s credential and used it to try logging in to more than 2,250 customers’ Microsoft 365 accounts.
Who is Storm-0940?
It is Microsoft’s name for a China state-aligned hacking group active since 2021 that focuses on stealing data.
What is ARTEX?
ARTEX is an open-source framework that lets AI agents run security testing tasks. Microsoft says the attackers used it to automate and speed up their intrusions.
Did two-factor authentication stop the attack?
No. The hackers signed in as the backup app itself, so there was no user password or two-factor prompt involved.
How do I know if my company was hit?
Ask your IT provider whether ConnectWise apps were linked to your Microsoft 365 account and check sign-in logs from October 15 to 17 for unusual app activity.
Based on reporting by TechCrunch, Reuters and Startup Fortune.
Leave a Reply