Storm-0940 uses agentic AI framework in ConnectWise attack

# Storm-0940 uses agentic AI framework in ConnectWise attack

https://gcdradar.vercel.app/incidents/storm-0940-uses-agentic-ai-framework-in-connectwise-attack · AIR-2026-1510 · closed 2026-11-04

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation)
- Fix status: No fix needed
- First reported: 2026-10-21
- AI role: AI-enabled attack
- Products: ConnectWise

## Summary

Microsoft linked a state-sponsored threat group to a supply chain attack that leveraged an agentic AI penetration testing framework. The tooling automated intrusions to target thousands of tenant accounts rapidly.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-10-21: Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group (https://cyberscoop.com/microsoft-attributes-connectwise-supply-chain-attack-china-storm-0940)

## Sources

- 2026-10-21 CyberScoop: Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group https://cyberscoop.com/microsoft-attributes-connectwise-supply-chain-attack-china-storm-0940

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.