Microsoft says China-aligned hackers used AI agents in ConnectWise breach affecting 2,250 cloud tenants

Summary

Microsoft says a China-aligned hacker breached ConnectWise and used the access to reach its customers' cloud tenants. According to The Register, AI agents did much of the intrusion work, and in some environments the hackers gained privileged access in under three hours; the outlet reports 2,250 cloud tenants were affected. TechCrunch reports that Microsoft blames the China-aligned hacker, which relied on AI agents to rapidly hack into thousands of ConnectWise customers. Tom's Hardware reports that Microsoft names the group Storm-0940, which used the ARTEX AI agent framework in the ConnectWise Cloud Backup supply chain attack, with agents attempting sign-ins at more than 2,250 Microsoft 365 tenants.

Timeline

1. The Register

   22 Oct 2026, 11:28 UTCSource ↗

   The Register reports that Microsoft says the ConnectWise breach let Chinese spies loose on 2,250 cloud tenants, with AI agents doing the work and hackers gaining privileged access in some environments in under three hours.

2. TechCrunch

   22 Oct 2026, 16:47 UTCSource ↗

   TechCrunch reports that Microsoft blames a China-aligned hacker for the ConnectWise breach, which relied on AI agents to rapidly hack into thousands of ConnectWise customers.

3. Tom's Hardware

   23 Oct 2026, 10:30 UTCSource ↗

   Tom's Hardware reports that Microsoft says China-aligned Storm-0940 used the ARTEX AI agent framework in the ConnectWise Cloud Backup supply chain attack, with agents attempting sign-ins at more than 2,250 Microsoft 365 tenants.