The group attacked a cloud backup service, targeting hundreds of accounts in days.
Microsoft has linked an attack on IT services firm ConnectWise's cloud backup service to Storm-0940, a Chinese state-aligned hacking group it has tracked since 2021.
The group used ARTEX, an open-source penetration testing framework that uses AI models to automate tasks. Between October 10 and 14, it targeted 327 accounts across eight organisations, generating more than 151,000 failed logins, and attempted sign-ins to over 2,250 customer tenants.
Some intrusions reportedly gained privileged cloud access in under three hours, though most attempts failed. Targets included aerospace, defence, energy, finance, government and semiconductor companies.
Microsoft said its own systems were not compromised. ConnectWise said services are being restored in phases. The Chinese embassy in Washington rejected the allegations.
