GoKawiilMicrosoft ties China-linked Storm-0940 group to ConnectWise Cloud Backup breach
Microsoft said the threat actor it tracks as Storm-0940 used compromised application credentials tied to ConnectWise Cloud Backup to try to access more than 2,250 downstream Microsoft 365 customer tenants. In some cases attackers reached privileged cloud access within three hours of targeting, and Microsoft said the group used an agentic AI penetration-testing framework to speed up the campaign. ConnectWise disclosed unauthorized access to its Cloud Backup application identities on Oct. 16 but has not said how attackers first obtained control of them.