Microsoft ties ConnectWise backup abuse to Storm-0940 and ARTEX
Sign-in attempts hit 2,900 a minute, with more than 111,000 failures on October 11 alone.
2
Stories per day · 30 days
2 RSS
Relatedconnectwise15microsoft-36514msp7supply-chain7credential-theft3entra-id3skykick3application-credentials2artex2credential-abuse2oauth2credential-access1credential-compromise1data-breach1entra1identity1saas1service-principal1
7 stories, newest first · one card per story
Stories tagged #cloud-backup
Chinese hackers used stolen ConnectWise backup credentials to reach customers
Microsoft says AI agents drove nearly 3,000 sign-in attempts a minute against about 2,250 organizations.
ConnectWise Cloud Backup breach page lacks incident details
The supplied SOCRadar page is site navigation and does not describe what was accessed or who was affected.
ConnectWise resets Cloud Backup credentials after unauthorized access
Huntress saw vendor-credential sign-ins from 144.172.64.128, then Global Administrator grants and new secrets on two tenants.
1
ConnectWise disables cloud apps after Microsoft 365 tenant access
Seven application identities were disabled October 17; Huntress says a later wave against 16 tenants failed.
5
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
Hackers abused ConnectWise Cloud Backup identities to access at least 162 Microsoft 365 tenants.
6
Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups
Stolen ConnectWise Cloud Backup credentials accessed 162 Microsoft 365 tenants, forcing ConnectWise to halt backups.
4