Microsoft links Storm-0940 to ConnectWise Cloud Backup attack
Original title: Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack
Compromised Cloud Backup application credentials were used to target more than 2,250 Microsoft 365 tenants.
Microsoft says the China-linked actor it tracks as Storm-0940 used compromised ConnectWise Cloud Backup application credentials in a supply-chain attack. The group tried to reach the Microsoft 365 environments of more than 2,250 downstream tenants and, in multiple cases, gained privileged cloud access in less than three hours. Microsoft says most targeting failed but privileged persistence was achieved at many organizations. ConnectWise disclosed the unauthorized access on October 16 and published containment guidance, without explaining the initial takeover.
Unconfirmed: How the application identities were first taken is unstated; the China link is Microsoft's assessment.
- Microsoft says the actor used an AI penetration-testing framework called ARTEX.
- The broader campaign began as early as September and hit hundreds of organizations.
- Named sectors include manufacturing, aerospace, chemicals, energy, defense, and financial services.
- ConnectWise has not publicly explained how the application identities were taken.
Impact: privileged access to customer Microsoft 365 cloud environments
| Product | Affected |
|---|---|
| ConnectWise Cloud Backup | — |
- 1.Review ConnectWise containment guidance for Cloud Backup application identities.
- Vendors
- ConnectWiseMicrosoft
- Threat actors
- Storm-0940
- Malware
- ARTEX
- Countries
- China
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 058ef0cfb57652bddd698609c655b901 | storm-backdoor-attacks#recipe=similar-items&sourcecontentid=058ef0cfb57652bddd698609c655b901) CISA Warns of 'Ongoing' Brickstorm Backdoor Attacks by Ro |
| md5 | 4056475ddaadba32176031a32b0b2af4 | omers-hacked-gainsight#recipe=similar-items&sourcecontentid=4056475ddaadba32176031a32b0b2af4) Deja Vu: Salesforce Customers Hacked Again, Via Gainsight |
| md5 | 772e2b458963b1a9ec224771cac5b591 | -orgs-high-end-malware#recipe=similar-items&sourcecontentid=772e2b458963b1a9ec224771cac5b591) Chinese APTs Hacking Asian Orgs With High-End Malware by |
From the original article
8 min read at darkreading.com
The China-linked actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants.
By Jai Vijayan · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.