INTERNATIONAL — Microsoft attributes a recently disclosed ConnectWise cloud-backup compromise to a China-aligned espionage group that used an AI-assisted testing framework to accelerate attacks on organizations worldwide.

Its October 21 research says Storm-0940 used the open-source ARTEX framework to target hundreds of organizations from September.

Microsoft reported some breaches reached privileged cloud access in under three hours. Most targeting failed, but some victims experienced persistent access.

Trusted application access was the route

It said attackers used compromised application identities and existing third-party permissions to enter Microsoft 365 environments without interactive user logins.

Microsoft cautioned that authentication alone does not prove information was read or stolen. The attribution is its assessment; no Canadian organization is identified here as a confirmed victim.

Restoration has begun in phases

ConnectWise's October 21 incident update said it had begun a controlled restoration after remediation and security checks, with the process expected to take several days. It said the start of restoration did not mean all capabilities were available.

The vendor said stored backup archives remained encrypted, isolated and preserved, with no indication of compromise. It separately warned that those findings did not establish whether individual customers' live Microsoft 365 environments had been affected.

ConnectWise told partners to keep affected connections disabled until receiving formal instructions for their service and to continue reviewing their own and managed customer environments. That vendor guidance matters to organizations using these services through an IT provider, including customers who do not administer their own cloud systems.

Sources: Microsoft Security research, October 21; ConnectWise incident notice, including its October 21 10:35 a.m. EDT update.

Editorial illustration of compromised trust between a cloud application and connected workplaces; not a depiction of an actual victim's network.