Microsoft says a China-aligned hacking group used AI agents to breach ConnectWise’s Cloud Backup service, opening a route into customers’ Microsoft 365 accounts.

Microsoft Threat Intelligence published its findings on Storm-0940 on October 21. ConnectWise disclosed the breach in a security advisory on October 16, the same day security firm Huntress published its initial account of the attack.

ConnectWise Cloud Backup, previously known as SkyKick, allows IT service providers to back up clients’ Microsoft 365 data. The service relies on applications with broad access to customer accounts, making those app identities a potential route into connected systems.

According to Microsoft, Storm-0940 compromised several of those identities and used them to access customer accounts.…