China-Linked Hackers Used ARTEX in ConnectWise Cloud Backup Attack

TL;DR - ConnectWise says a China state-aligned group appears responsible for the Cloud Backup supply chain attack. - The group used the ARTEX agentic AI framework to accelerate scanning, reconnaissance and OAuth application abuse, according to ConnectWise and Microsoft. - ConnectWise is restoring Cloud Backup in controlled phases and says affected connections should remain disabled until formal instructions are issued. - Partners should review their own and managed customer Microsoft 365 tenants for unauthorized access or changes.

What happened#

ConnectWise says it identified unauthorized access to application credentials associated with Cloud Backup, formerly known as SkyKick. The company says the incident affected application connections and that it has begun restoring services in controlled phases, with each step subject to remediation and security validation. Restoration is expected to take several days, and the start of restoration does not mean all capabilities are available. ConnectWise’s advisory says service-specific availability and reconnection instructions will be provided as they are confirmed.

In a separate update, ConnectWise said the evidence available to the company, including threat intelligence shared by Microsoft, indicates that a China state-aligned group was responsible. ConnectWise said the group used an openly available agentic AI framework to automate and speed up its operation.

Microsoft identifies the actor as Storm-0940 and names the framework ARTEX. Microsoft reports that ARTEX was used to accelerate scanning and reconnaissance, password spraying and OAuth application abuse against downstream victims. The framework allowed the actor to authenticate to Microsoft 365 customer environments through applications that had already been granted access, without requiring an interactive user sign-in. Microsoft’s account says follow-on activity included reconnaissance, application credential changes and attempts to modify privileges.

Microsoft reports that the campaign targeted hundreds of organizations globally across multiple industries. It also reports that some ARTEX-driven attacks obtained privileged access to cloud infrastructure in less than 3 hours from initial targeting.

Are you affected#

The directly identified ConnectWise service is Cloud Backup, formerly SkyKick. ConnectWise says affected application connections have been contained and that partners should keep them disabled until formal instructions apply to their service.

Organizations that use Cloud Backup, or manage Microsoft 365 environments connected to it, should treat their own tenant review as a separate task. ConnectWise says individual Microsoft 365 tenants still require review for unauthorized changes or persistent access. The company’s technical guidance covers reviewing a partner’s own tenant and each managed customer tenant, including legacy SkyKick integrations.

ConnectWise says existing backup archives remain encrypted, isolated and preserved, with no indication of compromise. The company also says it has no indication that other ConnectWise products, services or offerings are impacted by this incident. Those statements do not establish whether an individual partner or customer Microsoft 365 tenant was affected.

Microsoft reports that the presence of an affected application, or successful threat actor authentication, does not necessarily indicate that customer data was accessed or exfiltrated. It recommends reviewing service principal sign-ins and investigating unexpected application credential or privilege changes.

What is confirmed and what is reported#

What defenders should do now#

1. Keep affected Cloud Backup application connections disabled until ConnectWise provides formal, service-specific reconnection instructions. Do not treat the start of phased restoration as authorization to reconnect.

2. Review the organization’s Microsoft 365 tenant and every managed customer tenant connected to the service. Include legacy SkyKick integrations in the review.

3. Examine Microsoft Entra ID sign-in and audit logs, service principal sign-ins, application registrations, application credentials and permissions. Look for unexpected authentication, credential changes or privilege changes.

4. Investigate identities, groups and privileged roles for unauthorized modifications. Microsoft reports that application credential changes can create persistence through other identities, credentials and cloud services.

5. Preserve relevant evidence for investigation, including sign-in, audit, application and directory activity. Microsoft says Defender XDR provides detections and hunting queries for suspicious Microsoft Graph activity and known threat infrastructure.

6. Follow the current ConnectWise technical investigation and remediation guidance and use the company’s technical webinars for tenant review and remediation.

7. Report suspicious activity to ConnectWise at [email protected] and monitor the ConnectWise Trust Center for restoration updates and formal reconnection instructions.

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against the vendor’s own guidance for your environment.

Sources

• Primary notice: connectwise.com
• Research: microsoft.com
• Research: recordedfuture.com
• Report: thehackernews.com