Microsoft says China-linked group targeted 2,250 tenants via ConnectWise

Microsoft says Storm-0940 used stolen ConnectWise credentials and ARTEX to gain privileged access across thousands of Microsoft 365 tenants.

Microsoft says China-aligned Storm-0940 used compromised ConnectWise application credentials and open-source ARTEX to target more than 2,250 Microsoft 365 tenants. From October 10 to 14 it made more than 151,000 failed sign-ins against 327 accounts at eight organizations, then authenticated with ConnectWise app identities at about 2,900 attempts a minute and gained persistent privileged access at numerous organizations. TechCrunch says the group stole cloud-backup credentials and could reach customer email and files; The Register says Microsoft has not disclosed how many tenants were compromised or whether data was stolen. ConnectWise disabled Cloud Backup, SaaS Security, and Cloud Management and is investigating restoration. Microsoft says Storm-0940 has operated since at least 2021, with ARTEX use seen as early as September.