ConnectWise

Microsoft attributes the ConnectWise Cloud Backup compromise to the China-state-aligned actor Storm-0940 and reports that it used ARTEX to automate attacks and abuse stolen application identities across customer Microsoft 365 tenants. Microsoft says most targeting failed and that application exposure or a successful sign-in alone does not establish data access. ConnectWise’s October 28–29 updates describe phased restoration through a new application, requiring tenant reauthorization and verification that backups actually resume; they do not establish complete service restoration.