A compromised backup provider became a route into customers’ Microsoft 365 environments, according to Microsoft’s October 21 investigation. The ConnectWise Cloud Backup breach shows how attackers can misuse a service already trusted to reach business data—and why restoring that service may leave a separate cleanup job for its customers.
Microsoft attributes the campaign to Storm-0940, a China state-aligned group, and says it used ARTEX, an AI-driven security-testing framework, to accelerate attacks against hundreds of organizations. Most targeting failed, but some operations reached privileged cloud access in under three hours. Those observations describe this campaign, not a universal hacking speed.
What the ConnectWise Cloud Backup breach exposed
The attackers abused stolen application credentials and permissions previously granted to ConnectWise integrations. That let them authenticate without an interactive user login. In some customer environments, Microsoft observed reconnaissance and changes to application credentials or privileges that could maintain access through other identities.
A successful login does not, by itself, establish that data was read or stolen. Microsoft also says the activity did not result from a vulnerability in its own products or services.
ConnectWise first disclosed the incident on October 16. In its latest posted update, dated October 22 at 00:52 UTC, the company says phased restoration is underway and expected to take several days, subject to security checks. It reports no indication that encrypted, isolated backup archives were compromised.
Restoring the provider is only part of recovery
ConnectWise says individual Microsoft 365 environments still need review for unauthorized changes or persistent access. Its guidance is to keep affected connections disabled until formal instructions apply to the relevant service. A provider’s credential reset cannot automatically remove a separate identity or permission an intruder created downstream.
Reuters reports that ConnectWise’s chief executive considers a China state-aligned group the apparent perpetrator, based on available evidence and Microsoft’s analysis. China’s embassy rejected the accusation. Attribution remains an assessment, while the company has confirmed unauthorized access to application credentials.
The practical question for affected businesses is whether their own cloud permissions are clean, alongside whether backups are running again. AI can accelerate the attack; the lasting exposure comes from the access it leaves behind.
