Science & Tech · Cybersecurity · 3 hrs ago
Microsoft says Chinese-linked hackers compromised ConnectWise in global campaign
Microsoft says Chinese-linked hackers compromised IT firm ConnectWise as part of a campaign targeting hundreds of organisations worldwide.
Microsoft tracks the group as Storm-0940, and the Chinese Embassy did not immediately respond to a request for comment.
The hackers used ARTEX, an open-source tool that can use AI models to automate security testing tasks.
The campaign targeted organisations across many sectors, including government, finance, defence, energy and technology.
Most attempts were unsuccessful, but the group gained persistent high-level cloud access at many organisations, which could remain even after clean-up efforts.
ConnectWise said it was investigating unauthorised access attempts linked to its Cloud Backup environment.
The sources give no further details about what happens next.
Microsoft said a Chinese-linked group compromised IT services firm ConnectWise as part of a global campaign targeting hundreds of organisations.
Microsoft tracks the group as Storm-0940 and said it used the open-source ARTEX penetration testing framework.
The campaign targeted organisations across sectors including government, finance, defence, technology and manufacturing.
Microsoft said most targeting was unsuccessful, but the group gained high-level cloud access at many organisations.
ConnectWise said on Oct 16 that it was investigating unauthorised access attempts linked to its Cloud Backup environment.
- Who
- Microsoft attributed the campaign to Storm-0940, a Chinese-linked hacking group.
- What
- The group compromised ConnectWise and targeted hundreds of organisations globally.
- When
- Microsoft reported the campaign on Oct 21, 2026. ConnectWise said on Oct 16 that it was investigating access attempts.
- Where
- ConnectWise’s Cloud Backup environment and organisations around the world.
- Why
- Not stated
This story does not have two clearly opposing sides.
ConnectWise said it was investigating unauthorised access attempts associated with its Cloud Backup environment.
Microsoft said Storm-0940 had compromised ConnectWise in a campaign targeting hundreds of organisations globally.
- Attributed group
- Storm-0940
- Compromised company
- ConnectWise
- Tool used
- ARTEX, an open-source penetration testing framework
- Scale
- Hundreds of organisations targeted globally
- Campaign outcome
- Microsoft said most targeting was unsuccessful, but the group gained privileged cloud access at many organisations
What people are saying
investigating recent attempts of unauthorised access associated with the ConnectWise Cloud Backup environment