The group compromised ConnectWise Cloud Backup, according to Microsoft and ConnectWise.
ConnectWise CEO Manny Rivelo said the company contained affected application connections and was restoring services in controlled phases. He said those actions do not remove unauthorized access that may already have been established in individual customer tenants, which require separate review.
Microsoft said the attackers used ARTEX, an open-source penetration-testing framework that can use different AI models to automate penetration-testing tasks. The framework can be configured for autonomous reconnaissance and data exfiltration. Microsoft said most targeting attempts were unsuccessful, but that Storm-0940 obtained privileged cloud persistence at many organizations in a short period.
The report does not identify the AI models used, quantify affected ConnectWise customers, establish what data was accessed or exfiltrated, or provide a complete list of compromised organizations.