Storm-0940 used ConnectWise credentials against 2,250 Microsoft 365 tenants
Original title: Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants
Microsoft says the China-linked group used ARTEX and reached privileged cloud access at some organizations in under three hours.
Microsoft says China-aligned Storm-0940 combined compromised ConnectWise application credentials with the open-source ARTEX framework to target more than 2,250 Microsoft 365 tenants. From October 10 to 14 it made more than 151,000 failed sign-ins against 327 accounts at eight organizations, with no successful logins from that spraying. It then authenticated with ConnectWise app identities, sometimes at 2,900 attempts a minute, and gained persistent privileged access at numerous organizations. Microsoft has not said how many tenants were compromised or whether data was stolen.
Unconfirmed: Microsoft has not disclosed how many customers were compromised or whether data was stolen, and does not link this to the May 2025 ScreenConnect incident.
- ConnectWise disabled Cloud Backup, SaaS Security, and Cloud Management after unauthorized app access.
- Microsoft says Storm-0940 has operated since at least 2021.
- ARTEX use was seen as early as September against government, defense, banks, manufacturers, and tech firms.
- Graph activity included reconnaissance, application-credential changes, and privilege modifications.
- Closing ConnectWise connections may not remove attackers who already have a foothold.
Impact: Persistent privileged access in Microsoft 365 tenants
| Product | Affected |
|---|---|
| ConnectWise Cloud Backup, SaaS Security, and Cloud Management | — |
| Microsoft 365 | — |
- 1.Review and revoke unused ConnectWise application permissions in Microsoft 365.
- 2.Hunt for Graph privilege changes and new application credentials.
- Vendors
- MicrosoftConnectWise
- Products
- Microsoft 365ARTEX
- Threat actors
- Storm-0940
- Countries
- China
From the original article
2 min read at theregister.comAI agents did the dirty work, with hackers gaining privileged access in some environments in under three hours
By Carly Page · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.