Microsoft says a China-aligned hacking group used AI agents to breach ConnectWise's Cloud Backup service, giving it a route into customers' Microsoft 365 accounts.
Microsoft Threat Intelligence published its findings on October 21. It tracks the group as Storm-0940, which is Microsoft's working label for a threat actor rather than a name the group chose. ConnectWise had already disclosed the breach in a security advisory on October 16, the same day security firm Huntress published its initial account. The incident was public for five days before Microsoft added its attribution and the AI claim.
The people exposed are ConnectWise Cloud Backup customers whose Microsoft 365 accounts were reachable through the service. ConnectWise's advisory is the place to check for specifics on its side.
The access path is the familiar part. A backup service has to read the data it protects, so its connection to a cloud account is worth stealing. Compromising one vendor to reach many customers is the logic behind SolarWinds in 2020, and it keeps working because customers trust the vendor's connection by default.
The AI agents are the new claim, and they come from Microsoft's own analysis. The open question in the Storm-0940 report is what those agents actually did: whether they scouted systems, handled stolen credentials or moved between accounts, and how much happened without a human steering. That answer separates an old intrusion run faster from a change in how these attacks work, and defenders will want it before they decide which of the two they are facing.