[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-microsoft-links-ai-agent-attack-on-connectwise-to-storm-0940":10,"sections":44},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":43,"feedback_at":22,"cost_usd":43,"total_tokens":43},12153,"microsoft-links-ai-agent-attack-on-connectwise-to-storm-0940","Microsoft Links AI-Agent Attack on ConnectWise to Storm-0940","Microsoft says a China-aligned group used AI agents to reach customers' Microsoft 365 accounts through ConnectWise Cloud Backup.","Microsoft says a China-aligned hacking group used AI agents to breach ConnectWise's Cloud Backup service, giving it a route into customers' Microsoft 365 accounts.\n\nMicrosoft Threat Intelligence published its findings on October 21. It tracks the group as Storm-0940, which is Microsoft's working label for a threat actor rather than a name the group chose. ConnectWise had already disclosed the breach in a security advisory on October 16, the same day security firm Huntress published its initial account. The incident was public for five days before Microsoft added its attribution and the AI claim.\n\nThe people exposed are ConnectWise Cloud Backup customers whose Microsoft 365 accounts were reachable through the service. ConnectWise's advisory is the place to check for specifics on its side.\n\nThe access path is the familiar part. A backup service has to read the data it protects, so its connection to a cloud account is worth stealing. Compromising one vendor to reach many customers is the logic behind SolarWinds in 2020, and it keeps working because customers trust the vendor's connection by default.\n\nThe AI agents are the new claim, and they come from Microsoft's own analysis. The open question in the Storm-0940 report is what those agents actually did: whether they scouted systems, handled stolen credentials or moved between accounts, and how much happened without a human steering. That answer separates an old intrusion run faster from a change in how these attacks work, and defenders will want it before they decide which of the two they are facing.","[\"cybersecurity\",\"ai-agents\",\"supply-chain\",\"microsoft-365\"]","2026-10-22T13:31:44.000Z","2026-10-22T14:31:44.777Z","2026-10-22T14:31:45.010Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Remove the line 'The source material does not spell out what the AI agents did', which exposes the writer's sourcing limits to the reader, and the vague 'full technical write-up' reference; either state only what Microsoft's findings are reported to say, or frame the missing detail as an open question about Microsoft's Storm-0940 report without mentioning sources.","resolved","security",[32,33,34,35],"cybersecurity","ai-agents","supply-chain","microsoft-365",[37,40],{"name":38,"url":39},"The Next Web","https:\u002F\u002Fthenextweb.com\u002Fnews\u002Fmicrosoft-storm-0940-ai-agents-connectwise-attack",{"name":41,"url":42},"TechCrunch","https:\u002F\u002Ftechcrunch.com\u002F2026\u002F10\u002F22\u002Fchinese-hackers-spied-on-thousands-of-companies-after-breaching-it-giant-connectwise\u002F",0,{"sections":45},[46,51,55,60,65,70,75,80,85,90,95,100,105,110],{"name":47,"slug":48,"count":49,"latest_published_at":50},"AI","ai",7062,"2026-10-22T17:00:39.000Z",{"name":52,"slug":30,"count":53,"latest_published_at":54},"Security",1042,"2026-10-22T15:11:26.000Z",{"name":56,"slug":57,"count":58,"latest_published_at":59},"Policy","policy",570,"2026-10-22T16:00:29.000Z",{"name":61,"slug":62,"count":63,"latest_published_at":64},"Deals","deals",558,"2026-10-22T13:00:00.000Z",{"name":66,"slug":67,"count":68,"latest_published_at":69},"Hardware","hardware",287,"2026-10-22T16:18:47.000Z",{"name":71,"slug":72,"count":73,"latest_published_at":74},"Consumer Tech","consumer-tech",281,"2026-10-22T14:09:11.000Z",{"name":76,"slug":77,"count":78,"latest_published_at":79},"Science","science",214,"2026-10-22T14:59:28.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":84},"Startups","startups",142,"2026-10-22T16:05:08.000Z",{"name":86,"slug":87,"count":88,"latest_published_at":89},"Software","software",138,"2026-10-22T04:52:10.000Z",{"name":91,"slug":92,"count":93,"latest_published_at":94},"Dev Tools","dev-tools",122,"2026-10-21T16:00:00.000Z",{"name":96,"slug":97,"count":98,"latest_published_at":99},"General","general",96,"2026-10-22T16:00:00.000Z",{"name":101,"slug":102,"count":103,"latest_published_at":104},"Gaming","gaming",86,"2026-10-22T13:17:59.000Z",{"name":106,"slug":107,"count":108,"latest_published_at":109},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":111,"slug":112,"count":113,"latest_published_at":114},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]