Story perspectives

Storm-0940 used AI tools to breach ConnectWise Cloud Backup

By Drooid · Oct 22, 2026, 2:50 AM UTC · How we work

Summary

Story summary

Storm-0940, a Chinese state-aligned hacking group, used an AI-driven tool to breach ConnectWise Cloud Backup.
Microsoft said the group used the open-source ARTEX framework to automate reconnaissance and data exfiltration.
Despite most attempts failing, Storm-0940 gained privileged cloud persistence at many victims quickly.
ConnectWise CEO Manny Rivelo said the firm contained connections and began service restoration.
Rivelo warned unauthorized access may still exist in individual customer tenants and needs review.

1 of 1

Story summary

Storm-0940, a Chinese state-aligned hacking group, used an AI-driven tool to breach ConnectWise Cloud Backup.
Microsoft said the group used the open-source ARTEX framework to automate reconnaissance and data exfiltration.
Despite most attempts failing, Storm-0940 gained privileged cloud persistence at many victims quickly.
ConnectWise CEO Manny Rivelo said the firm contained connections and began service restoration.
Rivelo warned unauthorized access may still exist in individual customer tenants and needs review.