Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants

Microsoft says Chinese-linked espionage group Storm-0940 used compromised ConnectWise application credentials and AI agents to target more than 2,250 Microsoft 365 tenants. The activity matters because attackers gained persistent privileged access at numerous organisations, sometimes in under three hours, despite most attempts failing.

Microsoft observed the group using the open-source ARTEX framework to automate reconnaissance, credential attacks and attempts to change privileges. From 10 to 14 October, it recorded more than 151,000 failed sign-in attempts against 327 accounts at eight organisations; later activity reached up to 2,900 authentication attempts a minute across tenants. Microsoft has not said how many customers were compromised or whether data was stolen. ConnectWise says it contained the affected application connections and is restoring services.