Storm-0940 used AI tool Artex in ConnectWise customer intrusions
Microsoft logged more than 151,000 failed logons and successful sign-ins with ConnectWise cloud application identities.
2
Stories per day · 30 days
3 RSS
17 stories, newest first · one card per story
Stories tagged #password-spraying
Microsoft links ConnectWise breach to Storm-0940 using AI tool ARTEX
Stolen application credentials were used against 2,250 Microsoft 365 tenants, with privileged access in under three hours in some cases.
2
ARTEX-using actor expands targeting of IT and software vendors
The operator password-sprayed engineers, tested unsigned JWTs, and probed cross-tenant access on Okta, Entra ID and Cognito.
11
Storm-0940 used ConnectWise credentials against 2,250 Microsoft 365 tenants
Microsoft says the China-linked group used ARTEX and reached privileged cloud access at some organizations in under three hours.
1
Microsoft says Storm-0940 used AI to breach ConnectWise tenants
The group attempted more than 2,250 tenant sign-ins at about 2,900 per minute, often gaining access within three hours.
2
Storm-0940 used ARTEX against over 2,250 Microsoft 365 tenants
Stolen ConnectWise application credentials enabled Graph access; a separate spray of more than 151,000 logons had no successful authentication.
5
Storm-0940 used ARTEX in ConnectWise Cloud Backup supply-chain attack
Microsoft says the agents targeted more than 2,250 tenants at up to 2,900 sign-in attempts per minute.
1
Microsoft attributes ConnectWise supply-chain attack to Storm-0940
The group used ARTEX to reach more than 2,250 tenants at 2,900 sign-in attempts per minute; compromise counts are unstated.
1
FortiBleed is still active, with attackers locking admins out of Fortinet firewalls
FBI and Secret Service warn FortiBleed attackers continue compromising Fortinet firewalls — 86,644 devices verified — locking admins out and selling access to ransomware affiliates.
2
Hackers Broke Into Microsoft 365 Through Forgotten Accounts Nobody Was Watching
Proofpoint tracks UNK_CondorFiltration password-spraying campaign compromising seven unmonitored Microsoft 365 service accounts at Chilean organizations via TeamFiltration.
1
Hackers Target 5,700 Microsoft 365 Accounts Using Forgotten Service Accounts With No MFA
Proofpoint says UNK_CondorFiltration password-sprayed 5,700 Microsoft 365 accounts and breached seven MFA-less service accounts in Chile.
1
Automated AI agent used to breach cybersecurity nonprofit DIVD
DIVD says an autonomous AI agent exploited a flaw and performed a messy intrusion on its network.
TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords
Proofpoint details UNK_CondorFiltration, a TeamFiltration password-spray campaign against 5,700+ Microsoft 365 accounts that compromised seven default-password service accounts.
CISA Warns Hackers Exploit 17 Active Directory Techniques to Gain Control of Enterprise Networks
CISA and Five Eyes agencies issued joint guidance detailing 17 Active Directory attack techniques like Kerberoasting and DCSync, with hardening and detection advice.
3
Credential Theft: How Attackers Steal & Use Stolen Credentials
Huntress explains how attackers steal credentials through phishing, AitM, infostealers, and dumping, then use them for lateral movement, BEC, and ransomware.
The 20 Most Common Passwords Hackers Target in 2026
Huntress details the 20 most common passwords of 2026 and how attackers use brute force, spraying, and credential stuffing against weak credentials.
4
Password spraying campaign targets AWS root user accounts across 150+ organizations
Datadog researchers observed a password spraying campaign attempting to authenticate as AWS root users across 150+ organizations.
2