ConnectWise Supply Chain Attack: What the Storm-0940 Campaign Means for UK Businesses

Microsoft has attributed a supply chain compromise of the ConnectWise Cloud Backup application to Storm-0940, a threat actor assessed to be aligned with Chinese state interests. As reported by The Hacker News, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework, to automate the attack at scale — reaching more than 2,250 customer tenants at approximately 2,900 sign-in attempts per minute. ARTEX had previously been made closed-source following its abuse against South Korean financial institutions, but Storm-0940 continued to deploy it in this campaign. ConnectWise is widely used by managed service providers and IT teams for remote access, backup and endpoint management.

Why this matters for UK organisations

ConnectWise products are used extensively across the UK managed service provider ecosystem, meaning a supply chain compromise of this kind has the potential to affect not just direct customers but the downstream organisations those providers support. The use of AI-assisted automation to accelerate credential attacks at the scale described represents a meaningful shift in attacker capability. Traditional assumptions about detection windows and response time are challenged when an adversary can probe thousands of tenants in minutes rather than hours. For UK organisations that rely on managed service providers for IT support, remote access or backup services, this incident raises important questions about supply chain visibility: what tools do your providers use, how quickly do they patch and communicate, and what notification processes exist if their own tooling is compromised?

What to review

Organisations using ConnectWise directly should check with the vendor for specific guidance on affected versions and any indicators of compromise. Those using managed service providers that rely on ConnectWise should ask their provider directly whether they were affected and what steps have been taken. More broadly, this is a useful prompt to review the access permissions granted to third-party management tools — particularly those with remote access or administrative capabilities — and to ensure that supplier security questionnaires or due diligence processes include questions about the tools and platforms those suppliers use internally. Supply chain risk does not stop at the first tier.

Source: The Hacker News