Storm-0940 abuses ARTEX AI agents and stolen ConnectWise Cloud Backup (SkyKick) app credentials against 2,250+ Microsoft 365 tenants
Microsoft attributes the supply-chain compromise of ConnectWise Cloud Backup (formerly SkyKick) to Storm-0940, a China-linked actor active since at least 2021. The group has used the AI penetration-testing framework ARTEX since at least September 2026 against hundreds of organizations (cyberscoop.com, thehackernews.com, securityweek.com).…