China-linked hackers used ConnectWise as a cloud back door, Microsoft says

China-aligned hackers used ConnectWise’s cloud-backup applications to reach customer environments in an AI-assisted campaign, Microsoft said on 21 October. The group, tracked as Storm-0940, targeted hundreds of organisations, including defence companies, government bodies and think tanks.

The shortcut was trust already granted. Compromised application identities let the attackers authenticate to Microsoft 365 environments without an interactive user sign-in. Microsoft observed reconnaissance and changes to credentials and privileges that could maintain access after the original application was cleaned up.

Speed compressed the response window. Microsoft said some attacks reached privileged cloud access in under three hours. Most targeting failed. A separate burst of password attempts against 327 accounts produced more than 151,000 failed logins and no observed successful authentication in that subset.

The company cautioned that an affected application or successful login does not establish that customer data was read or stolen. It said the activity did not result from a compromise of Microsoft’s own systems or products. Its attribution identifies a China-aligned group, without naming an intelligence agency.

ConnectWise chief executive Manny Rivelo backed the attribution and said affected connections had been contained, Reuters reported. Services were returning in controlled phases, but access already established inside individual customer environments required separate review.

China’s embassy told Reuters that China fights hacking and opposed accusations made under the pretext of cybersecurity.