Microsoft attributes ConnectWise supply‑chain breach to China‑aligned Storm‑0940 group

Microsoft's threat‑intelligence team has publicly linked a recent supply‑chain intrusion that compromised ConnectWise customers' Microsoft 365 environments to a China‑state‑aligned hacking collective tracked as Storm‑0940.

The breach unfolded when malicious code was embedded in routine ConnectWise software updates. Once installed, the code opened a backdoor into the Microsoft 365 tenants of dozens of managed‑service providers that rely on ConnectWise for remote monitoring and management. The attackers then leveraged the foothold to harvest credentials, exfiltrate data and move laterally across corporate networks.

In its attribution report, Microsoft cited a series of technical indicators that point to Storm‑0940, including reused code signatures, a distinctive command‑and‑control architecture, and the deployment of an “agentic AI penetration testing framework.” The framework, first observed in September 2026, automates vulnerability discovery and exploit generation, a capability that Microsoft says aligns with the group’s known operational patterns.

Supply‑chain attacks have become a preferred vector for sophisticated actors because they grant access to multiple downstream victims through a single compromised vendor. The ConnectWise incident follows high‑profile cases such as the SolarWinds and Kaseya intrusions, underscoring the strategic value of software that sits at the heart of managed‑service operations. By targeting a platform used by hundreds of MSPs, the threat group maximized its reach with relatively modest effort.

Microsoft has issued emergency guidance urging affected organizations to rotate privileged accounts, apply the latest security patches, and conduct a thorough review of any anomalous activity in their Microsoft 365 environments. ConnectWise has pledged to work with customers to roll back the compromised updates and strengthen its code‑signing processes. Federal law‑enforcement agencies have been notified, and the attribution may feed into broader diplomatic discussions about state‑sponsored cyber activity.

Analysts warn that the use of AI‑driven tooling could lower the technical barrier for advanced intrusion campaigns, making such attacks more frequent. Both Microsoft and independent security firms say they will intensify monitoring for similar AI‑enhanced tactics and continue to share threat intelligence with the wider community to mitigate future supply‑chain risks.