Storm-0940 Exploited ConnectWise Cloud Backup in Supply Chain Attack, Microsoft Says

What happened

Microsoft disclosed that Storm-0940, a China state-aligned threat actor, was behind a recent supply chain compromise of the ConnectWise Cloud Backup application. During the intrusion, the group used ARTEX, a Go-based agentic AI penetration testing framework, to accelerate scanning and exploitation activity. ARTEX was reportedly made closed-source after it was previously abused in attacks against South Korean financial institutions. Specific technical details of the compromise mechanism and scope of affected ConnectWise customers were not disclosed in the available reporting.

Why it matters

ConnectWise's backup tooling is widely used by managed service providers (MSPs) and IT administrators, making it an attractive supply chain target — a single compromise upstream can cascade into access across many downstream customer environments. The use of an AI-assisted penetration testing framework by a state-aligned actor also signals that adversaries are increasingly operationalizing agentic AI tooling to speed up reconnaissance and exploitation, which may shorten attacker dwell-to-impact timelines. Organizations relying on ConnectWise Cloud Backup, or on MSPs who use it, should treat this as a potential upstream exposure.

What defenders should watch for

• Review ConnectWise Cloud Backup deployments for unexpected configuration changes, new service accounts, or unfamiliar outbound connections following any vendor-issued advisory.
• Monitor for anomalous, rapid, or scripted scanning behavior against internal assets — a potential signature of AI-agent-driven reconnaissance rather than manual attacker activity.
• Hunt for unusual process execution or network activity tied to backup agent software, especially any abnormal privilege escalation or lateral movement originating from systems running ConnectWise tooling.
• Watch vendor and threat intel channels for ConnectWise's own advisory and indicators of compromise, since none were included in this initial report.
• Apply standard MSP/supply-chain hardening: least-privilege service accounts, network segmentation around backup infrastructure, and close review of third-party software update channels.

This is developing intelligence based on an initial Microsoft disclosure, and many details — including full scope, affected versions, and indicators of compromise — have not yet been made public. Defenders should follow up directly with ConnectWise and Microsoft for official guidance as it emerges. Original reporting: The Hacker News.