Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack

According to Microsoft, the China-linked threat actor Storm-0940 conducted a supply chain attack targeting ConnectWise in October 2026. The actor is alleged to have used an AI-enabled penetration-testing tool to automate and accelerate the attack chain, resulting in the compromise of more than 2,200 tenant environments. Microsoft notes that the use of AI for automation represents an emerging trend in supply chain intrusions. The report indicates that the attack facilitated potential data exfiltration and lateral movement, though specific technical methodology and the exact volume of data exfiltrated remain unconfirmed. Microsoft has attributed the activity to Storm-0940 based on intelligence alignment with prior reporting on China-linked actors. No direct patch has been issued; affected organizations are advised to review security configurations and apply vendor-recommended mitigations.