Microsoft Attributes ConnectWise Cloud Backup Attack to China-Aligned Storm-0940
Summary
Microsoft attributes attacks on ConnectWise Cloud Backup customers’ Microsoft 365 environments to Storm-0940, which allegedly used ARTEX for password spraying and OAuth abuse. ConnectWise is restoring services; the number of compromised customers is unknown.
Key points
- Microsoft attributes the ConnectWise Cloud Backup supply-chain campaign to China-aligned threat actor Storm-0940.
- Before the ConnectWise compromise, Microsoft observed more than 151,000 failed sign-ins targeting 327 Microsoft 365 and Exchange Online accounts across eight organizations over four days.
- Microsoft says Storm-0940 used ARTEX to automate scanning and password spraying, and abused OAuth applications in downstream customer environments.
- Microsoft observed activity involving Microsoft Graph and directory operations, including credential modifications, persistence, and changes to identities, groups, and privileged roles.
- Microsoft did not disclose how many customers were compromised and cautioned that successful authentication does not necessarily mean data was accessed or stolen.
- ConnectWise temporarily shut down services and began phased restoration; it advised customers to keep connections disabled and said recovery would take several days.
Article Details
- Victim Organization
- ConnectWise
- Incident Type
- Supply-chain attack targeting ConnectWise Cloud Backup customers’ Microsoft 365 environments, involving password spraying and abuse of OAuth applications.
- Operational Impact
- ConnectWise temporarily shut down services and began restoring them in phases. Microsoft identified evidence of follow-on activity in multiple customer environments but did not disclose how many customers were compromised. Successful authentication did not necessarily mean data was accessed or stolen.
- Claim Status
- alleged
MITRE ATT&CK
T1098.001 · Additional Cloud CredentialsMicrosoft reported application credential modifications to establish persistence.T1098.003 · Additional Cloud RolesMicrosoft reported changes involving identities, groups, and privileged roles.T1110.003 · Password SprayingMicrosoft reported that Storm-0940 conducted password-spraying attacks against Microsoft 365 and Exchange Online accounts.
People
Threat Actors
Vendors
ConnectWiseMicrosoft researchers attributed the recent supply-chain attack targeting ConnectWise customers’ Microsoft 365 environments to a China-state aligned threat actor it tracks as Storm-0940.MicrosoftMicrosoft researchers attributed the recent supply-chain attack targeting ConnectWise customers’ Microsoft 365 environments to a China-state aligned threat actor it tracks as Storm-0940.
Products
ConnectWise Cloud BackupStorm-0940 initiated a widespread, but ultimately unsuccessful, password-spraying campaign immediately preceding the compromise of ConnectWise’s Cloud Backup service.Exchange Online14, Storm-0940 targeted 327 Microsoft 365 and Exchange Online accounts across eight organizations, researchers said.Microsoft 365 Apps for EnterpriseMicrosoft researchers attributed the recent supply-chain attack targeting ConnectWise customers’ Microsoft 365 environments to a China-state aligned threat actor it tracks as Storm-0940.Microsoft Graphenvironments, the AI agents (on behalf of the threat actor) progressed beyond authentication to Microsoft Graph and directory operations, including reconnaissance, application credential modifications to establish
Tools
Industries
Aerospace and defenseThe nation-state group, which has been active since 2021, targeted organizations in aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military,Automotivenation-state group, which has been active since 2021, targeted organizations in aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military,Chemicalsgroup, which has been active since 2021, targeted organizations in aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors,Energywhich has been active since 2021, targeted organizations in aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software,Financial Servicesactive since 2021, targeted organizations in aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, thinkGovernmenttargeted organizations in aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks andLegalorganizations in aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks and non-profits.Manufacturingin aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks and non-profits.Mediaand defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks and non-profits.Militaryand defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks and non-profits.Non-profitlegal, manufacturing, media, military, semiconductors, software, technology, think tanks and non-profits.Semiconductorsautomotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks and non-profits.Softwareenergy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks and non-profits.Technologyfinancial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks and non-profits.Think tanksservices, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks and non-profits.