ConnectWise Cloud Backup Compromised, Leading to Targeted Attacks on 2,250 Microsoft 365 Tenants

A China state-aligned threat actor, Storm-0940, exploited a compromised ConnectWise Cloud Backup service to attempt sign-ins against over 2,250 Microsoft 365 tenants. The attackers utilized ARTEX, an open-source, Go-based agentic AI penetration-testing framework, to automate scanning, password spraying, and OAuth application abuse, highlighting the increasing use of AI in sophisticated cyberattacks.