cyber.hendryadrian.com
Cyber Attack & Data Breach · darkreading.com

Microsoft Links Storm-0940 to ConnectWise Cloud Backup Supply-Chain Attack

· Original article ↗

Summary

Microsoft says China-linked Storm-0940 used ARTEX and compromised ConnectWise Cloud Backup application credentials to target over 2,250 Microsoft 365 tenants; some attacks gained privileged access. ConnectWise suspended services and continued restoration.

Key points

  • ConnectWise disclosed unauthorized access to application identities associated with its Cloud Backup product on Oct. 16; it has not publicly explained how the attackers gained control of them.
  • Microsoft attributed the activity to China-linked Storm-0940 and described it as part of a campaign targeting hundreds of organizations worldwide since at least September.
  • Storm-0940 used the ARTEX agentic AI penetration-testing framework to accelerate reconnaissance, scanning, password spraying, and OAuth application abuse.
  • Microsoft said the actor attempted sign-ins to more than 2,250 tenants, at a rate of up to 2,900 attempts per minute; most targeting was unsuccessful.
  • In multiple instances, attackers obtained privileged cloud access in less than three hours after initial targeting. Microsoft also observed Microsoft Graph reconnaissance, application credential changes, and attempted privilege modifications.
  • ConnectWise took Cloud Backup, SaaS Security, and Cloud Management offline; restoration work was ongoing in its Oct. 22 update, which urged customers to keep affected connections offline.
  • ConnectWise said existing backup archives remained encrypted, isolated, and preserved, with no indication of compromise. Microsoft advised reviewing potentially affected tenants and preserving logs and forensic evidence.

Article Details

Victim Organization
ConnectWise
Incident Type
Supply-chain attack involving compromised application identities, password spraying, and OAuth application abuse.
Operational Impact
ConnectWise suspended Cloud Backup and took its SaaS Security and Cloud Management services offline. Microsoft said Storm-0940 attempted sign-ins to more than 2,250 downstream customer tenants, and attackers obtained privileged access in multiple affected environments. Microsoft said most targeting was unsuccessful. ConnectWise said existing backup archives remained encrypted, isolated, and preserved, with no indication they were compromised.
Claim Status
confirmed

MITRE ATT&CK

T1110.003 · Password SprayingMicrosoft reported that Storm-0940 used password spraying during the activity.

People

Jon BakerVice president of threat informed defense at AttackIQ; advised affected organizations to preserve sign-in and audit records and investigate application activity.Ross FilipekCISO at Corsica Technologies; advised affected organizations to investigate their Microsoft 365 environments and preserve evidence before reconnecting.

Threat Actors

Storm-0940Microsoft attributed the activity to this China-linked threat actor.

Vendors

ConnectWiseA China-linked threat actor that Microsoft tracks as Storm-0940 used an agentic AI penetration-testing framework to accelerate a supply chain attack involving ConnectWise Cloud Backup.MicrosoftA China-linked threat actor that Microsoft tracks as Storm-0940 used an agentic AI penetration-testing framework to accelerate a supply chain attack involving ConnectWise Cloud Backup.

Products

Cloud ManagementConnectWise suspended its Cloud Backup service and also took its SaaS Security and Cloud Management services offline following the incident. In an Oct. 22 update, the company noted it was continuing work on restoringConnectWise Cloud BackupA China-linked threat actor that Microsoft tracks as Storm-0940 used an agentic AI penetration-testing framework to accelerate a supply chain attack involving ConnectWise Cloud Backup.Microsoft 365 Apps for Enterpriseused compromised application credentials associated with the service to attempt to access the Microsoft 365 environments of more than 2,250 downstream customer tenants. In multiple instances, the attackersSaaS SecurityConnectWise suspended its Cloud Backup service and also took its SaaS Security and Cloud Management services offline following the incident. In an Oct. 22 update, the company noted it was continuing work on restoring

Tools

ARTEXand financial services. The threat actor has been using an AI penetration-testing framework called ARTEX to automate and accelerate its operations.

Countries

ChinaA China-linked threat actor that Microsoft tracks as Storm-0940 used an agentic AI penetration-testing framework to accelerate a supply chain attack involving ConnectWise Cloud Backup.

Industries

Aerospaceand targeted hundreds of organizations worldwide across several industries including manufacturing, aerospace, chemicals, energy, defense, and financial services. The threat actor has been using an AIChemicalshundreds of organizations worldwide across several industries including manufacturing, aerospace, chemicals, energy, defense, and financial services. The threat actor has been using an AI penetration-testingDefenseorganizations worldwide across several industries including manufacturing, aerospace, chemicals, energy, defense, and financial services. The threat actor has been using an AI penetration-testing framework called ARTEXEnergyof organizations worldwide across several industries including manufacturing, aerospace, chemicals, energy, defense, and financial services. The threat actor has been using an AI penetration-testing frameworkFinancial Servicesacross several industries including manufacturing, aerospace, chemicals, energy, defense, and financial services. The threat actor has been using an AI penetration-testing framework called ARTEX to automate andManufacturingas September and targeted hundreds of organizations worldwide across several industries including manufacturing, aerospace, chemicals, energy, defense, and financial services. The threat actor has been using an AI

Related Articles