Microsoft Attributes Massive ConnectWise Breach to China‑Linked Storm‑0940 Group Using AI‑Driven Tools

Microsoft's security team has linked a recent, large‑scale compromise of ConnectWise’s supply chain to the China‑affiliated threat actor known as Storm‑0940, revealing that the group leveraged an artificial‑intelligence‑enhanced penetration‑testing utility to expedite the intrusion across more than 2,200 tenant environments.

The investigation, first reported by Dark Reading, indicates that the malicious actors repurposed a legitimate AI‑based testing platform to automate credential harvesting, lateral movement and data exfiltration. By integrating the tool into their workflow, Storm‑0940 was able to scale the attack rapidly, targeting a broad swath of managed‑service‑provider (MSP) customers that rely on ConnectWise’s remote monitoring and management solutions.

ConnectWise, a provider of software that enables MSPs to deliver IT services to small and medium‑size businesses, has long been a high‑value target for supply‑chain adversaries. Compromising the platform grants attackers indirect access to the networks of dozens of downstream clients, amplifying the potential impact of a single breach. The latest episode underscores how attackers are increasingly exploiting trusted third‑party services to broaden their foothold.

Microsoft’s attribution rests on a combination of technical indicators, including unique command‑and‑control patterns, code reuse, and the deployment of the AI‑enabled tool that matches previous Storm‑0940 activity. The group’s known affiliation with Chinese state‑linked entities adds a geopolitical dimension, as such actors are often motivated by intelligence‑gathering and disruption objectives.

Security experts note that the use of AI‑driven penetration‑testing software marks a shift in attacker methodology. While such tools are designed to help defenders identify vulnerabilities, their automation capabilities can be co‑opted for malicious purposes, allowing threat actors to scan large environments and prioritize high‑value assets with minimal manual effort.

In response, Microsoft has advised customers of ConnectWise to apply the latest security patches, review privileged account usage, and monitor for anomalous activity associated with the identified indicators of compromise. ConnectWise has pledged to work closely with affected parties and to enhance its threat‑detection capabilities. The episode serves as a reminder that supply‑chain security remains a critical concern, and that organizations must adopt layered defenses, including zero‑trust architectures and continuous monitoring, to mitigate the risk of AI‑augmented attacks.