Storm-0940 targeted 2,250 Microsoft 365 tenants with stolen ConnectWise credentials
Original title: Hackers Use AI Agents to Target Over 2,250 Microsoft 365 Tenants Through ConnectWise
Microsoft says the ARTEX agent framework drove the campaign; Huntress rates the AI claim lower from its own telemetry.
Microsoft says Storm-0940, which it calls a China-state-aligned group, used stolen ConnectWise application credentials and its ARTEX framework to attempt access to more than 2,250 Microsoft 365 tenants. The activity used permissions customers had already granted, not a newly disclosed Microsoft vulnerability, and application sign-ins bypassed ordinary user MFA prompts. Huntress examined the abuse and saw rapid tenant sweeps, secret changes, and a Teams identity assigning itself Global Administrator. Microsoft says targeting is not the same as confirmed data theft.
Unconfirmed: Huntress rates AI involvement low-to-medium from its telemetry, rising to medium-to-high only with Microsoft’s attribution.
- Earlier reporting documented unauthorized sign-ins across 173 partner and customer tenants.
- Huntress saw most activity on October 15 inside a window under 14 hours.
- One sweep processed almost 1,000 tenants in ascending identifier order.
- A separate password-spray phase logged more than 151,000 failed logons against 327 accounts.
- Missing Graph activity logs leave successful reads and theft unproven.
Impact: Attempted cloud access and possible administrative control
- 1.Alert on apps assigning themselves powerful roles or adding unexpected credentials.
- 2.Keep affected connections disabled until Microsoft restoration guidance arrives.
- 3.Enable Graph logging and review mailbox, file, and role-assignment activity.
- ATT&CK
- T1078.004 Valid Accounts: Cloud AccountsT1098.001 Additional Cloud CredentialsT1098.003 Additional Cloud RolesT1110.003 Password Spraying
- Vendors
- MicrosoftConnectWise
- Products
- Microsoft 365
- Threat actors
- Storm-0940
- Malware
- ARTEX
- Organizations
- Huntress
- Countries
- China
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 144.172.64.128 | ors of compromise (IoCs):- Type Indicator Source context IP 144.172.64[.]128 Application sign-ins and Graph activity IP 144.172.64[.]9 |
| ipv4 | 144.172.64.60 | 194.165.16[.]21 Possible link through reused user agent IP 144.172.64[.]60 ConnectWise and Microsoft indicator User agent Python-url |
| ipv4 | 144.172.64.99 | 144.172.64[.]128 Application sign-ins and Graph activity IP 144.172.64[.]99 October 10–14 cross-tenant password spraying IP 194.165.1 |
| ipv4 | 194.165.16.21 | 172.64[.]99 October 10–14 cross-tenant password spraying IP 194.165.16[.]21 Possible link through reused user agent IP 144.172.64[.]6 |
From the original article
3 min read at cybersecuritynews.com
Hackers used AI agents and stolen ConnectWise application credentials to attempt access to more than 2,250 Microsoft 365 tenants, according to Microsoft’s technical investigation report. Microsoft attributed the campaign to Storm-0940, a China-state-aligned group, and said its ARTEX framework accelerated reconnaissance, authentication attempts, and cloud persistence.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.