Dilara Hamit
22 October 2026•Update: 22 October 2026
A Chinese state-aligned hacking group used an artificial intelligence-powered security testing tool in a campaign that compromised IT services firm ConnectWise and targeted hundreds of organizations worldwide, Microsoft said Wednesday.
In a security blog, Microsoft attributed the activity to Storm-0940, a group it says has operated since 2021. Targets included government, defense, energy, financial services, and technology organizations.
The hackers used ARTEX, an open-source penetration testing framework that connects to AI models to automate tasks ranging from identifying weaknesses to stealing data.
Penetration testing is normally used to assess security, but Microsoft said the attackers used the framework to accelerate their operations.
In several cases, attackers gained high-level access to cloud systems less than three hours after selecting a target. Most attempts failed, but the group established persistent access at many organizations, Microsoft said.
Successful sign-ins did not necessarily mean customer data had been accessed or stolen, it added.
ConnectWise said its evidence, including Microsoft's threat intelligence, indicated that a Chinese state-aligned group was responsible for the attack on Cloud Backup, formerly known as SkyKick.
The company said it had contained the affected application connections and begun restoring services in phases following security checks.
However, it warned that those steps would not eliminate unauthorized access potentially established inside individual customer Microsoft 365 environments, which require separate investigation.
In an update Thursday, ConnectWise said restoration was expected to take several days. Existing backup archives remained encrypted, isolated, and preserved, with no indication they had been compromised, it said.
The company urged customers to keep affected connections disabled until it issued formal reconnection instructions.
ConnectWise said the original mechanism by which the credentials were exposed remained under investigation. It had not established whether a product vulnerability contributed to the incident.
China's Embassy in Washington rejected accusations implicating Beijing, saying China opposes hacking and what it described as attempts to smear the country.
