Microsoft Reports Storm-0940 Used Artex in ConnectWise Customer Attacks

Summary

Microsoft and Huntress report that Storm-0940 used Artex to automate attacks on ConnectWise customers, with activity involving hundreds of Microsoft 365 tenants. ConnectWise suspended several services.

Key points

• Microsoft says China-linked Storm-0940 used the open-source Artex framework to automate reconnaissance, password spraying, and OAuth application abuse.
• Huntress observed compromised ConnectWise application credentials used to access hundreds of Microsoft 365 tenants, including more than 300 Entra tenants.
• Microsoft reported activity targeting over 300 accounts across eight organizations at more than 2,900 attempts per minute, alongside over 151,000 failed logon events.
• Microsoft observed successful authentication to customer environments using identities of multiple ConnectWise cloud applications.
• In some environments, Microsoft observed Microsoft Graph and directory operations, including application credential changes to establish persistence and changes involving identities, groups, and privileged roles.
• ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services in response.
• Microsoft advised examining service principal sign-ins alongside subsequent Microsoft Graph activity, directory changes, and resource access.