Chinese hackers target hundreds of organizations in AI-powered ConnectWise breach

Microsoft said a China-linked hacking group used an AI-powered penetration-testing tool to breach ConnectWise in a global campaign targeting hundreds of organizations. ConnectWise CEO Manny Rivelo said evidence pointed to China-backed hackers in the attack on its Cloud Backup system; the company suspended Cloud Backup, SaaS Security, and Cloud Management services and later restored them in phases after saying the threat was contained. Microsoft attributed the breach to Storm-0940, a cyberespionage group active since 2021 that targets sectors, and said it used password spraying before pivoting from 327 Microsoft 365 and Exchange Online accounts at eight companies to ConnectWise users. Huntress said one stolen credential led to 162 compromised tenants, and Microsoft warned backdoors may remain in customer networks afterward.