Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants

Summary

Microsoft attributes an AI-assisted cloud intrusion campaign to Storm-0940, a China-linked espionage actor. According to the supplied reporting, the group used the ARTEX penetration-testing framework and compromised ConnectWise application credentials to attempt authentication against more than 2,250 Microsoft 365 tenants. That figure represents the targeting footprint, not a confirmed count of compromised tenants; most authentication attempts reportedly failed.^[0]

The reported sequence moved from unsuccessful password spraying to abuse of trusted application identities. Between October 10 and 14, the attackers made more than 151,000 failed sign-in attempts against 327 accounts at eight organizations, with no successful logins observed from that activity. They then used compromised ConnectWise credentials to exercise permissions already granted by customers, avoiding the need for an interactive user login. Microsoft also observed reconnaissance, application credential changes, and attempted privilege modifications through Microsoft Graph.^[0]

Despite the high failure rate, Microsoft reported that the attackers established persistent privileged access at numerous organizations, with some attacks reaching privileged cloud access in under three hours. The number of compromised customers and whether data was stolen remain undisclosed. ConnectWise said it had contained affected application connections and was gradually restoring services, but disabling those connections would not necessarily remove footholds already established inside customer environments.^[0]

Attack chain

1. 1. Password-spraying attempts: Between October 10 and 14, Storm-0940 conducted more than 151,000 failed sign-in attempts against 327 accounts at eight organizations. Microsoft observed no successful logins from this password-spraying activity.^[0]
2. 2. Shift to compromised application identities: The attackers shifted to compromised ConnectWise application credentials. These credentials enabled use of permissions that customers had already granted to ConnectWise services, without requiring an interactive user login. The reporting does not describe how the application credentials were initially obtained.^[0]
3. 3. Scaled tenant authentication: Using ARTEX, Storm-0940 attempted authentication against more than 2,250 Microsoft 365 tenants, at times reaching 2,900 attempts per minute. Most attempts failed, so the attempted tenant population should not be treated as the victim count.^[0]
4. 4. Graph activity and privileged persistence: Microsoft observed AI-accelerated Microsoft Graph reconnaissance, application credential changes, and attempts to modify privileges. It also reported persistent privileged access at numerous organizations. The described changes could permit continued access after revocation of the original compromised credentials, although the report does not establish that every attempted privilege change succeeded.^[0]

Disclosure timeline

Actor profile

Storm-0940

Microsoft identifies Storm-0940 as a China-linked espionage actor operating since at least 2021. Its previously reported methods include password spraying and exploitation of internet-facing applications. In this activity, Microsoft described ARTEX-assisted operations and abuse of compromised ConnectWise application identities. Reported targeting spans government agencies, defense contractors, banks, manufacturers, and technology firms worldwide. ARTEX use is not exclusive to this actor: Microsoft also reported use by attackers from several geographic regions.^[0]

How it works

The access mechanism described is application-identity abuse: compromised ConnectWise application credentials allowed the attackers to use permissions customers had already granted to ConnectWise services. This provided a path into Microsoft 365 environments without an interactive user login. The supplied reporting does not identify the original credential-compromise mechanism or a specific software vulnerability responsible for it.^[0]

Microsoft Graph was used for reconnaissance, application credential changes, and attempted privilege modifications. The persistence concern is that attacker-established credentials or privileges could outlive revocation of the original ConnectWise credentials. Accordingly, containment of the vendor connection and removal of access established inside a customer tenant are distinct remediation questions.^[0]

ARTEX is described as a Go-based, open-source penetration-testing framework whose AI agents can automate reconnaissance, vulnerability discovery, credential attacks, and data theft. Those framework capabilities should not be equated with confirmed outcomes in this campaign: the reporting documents authentication attempts and privileged persistence, but does not establish that data was stolen.^[0]

Affected versions and patch status

Key takeaways

• More than 2,250 tenants were targeted, not confirmed compromised. Microsoft reported persistent privileged access at numerous organizations without disclosing a precise victim count.^[0]
• The consequential trust boundary was the customer-granted application permission set. Compromised vendor application credentials enabled access without an interactive user login.^[0]
• Revoking the original vendor credentials is not, by itself, evidence of complete eviction. Application credential changes and privilege modifications require separate investigation for persistent access.^[0]
• The reported AI contribution was acceleration and scale of established techniques, including credential attacks and application abuse. Microsoft reported some target-to-privileged-access intervals below three hours, while also noting that ARTEX is used by attackers beyond Storm-0940.^[0]

Defensive actions

• Investigate application-identity authentication associated with the affected ConnectWise integrations, rather than limiting review to interactive user sign-ins.: The reported access path used compromised application credentials and pre-existing customer grants without an interactive user login. Microsoft reported high-volume authentication attempts across more than 2,250 tenants, but most failed; investigation should distinguish attempted authentication from successful access.^[0]
• Review Microsoft Graph activity for reconnaissance, application credential changes, and privilege modifications associated with the affected application identities.: These are the post-authentication behaviors Microsoft specifically reported. Credential changes and privilege modifications are particularly relevant to determining whether access was extended beyond the original compromised connection.^[0]
• Validate containment of affected ConnectWise application connections and separately investigate and remove unauthorized credentials or privileges established inside the tenant.: ConnectWise reported containing the affected connections, but the reporting explicitly warns that shutting them down would not necessarily evict attackers with an established foothold. Microsoft reported persistent privileged access at numerous organizations.^[0]
• Review the October 10–14 password-spraying window separately from the application-identity compromise investigation.: Microsoft reported more than 151,000 failed attempts against 327 accounts at eight organizations, with no successful logins observed from that spraying activity. A lack of successful user authentication in that window would not resolve the later, distinct application-credential access path.^[0]
• For any successful authentication, assess subsequent activity before concluding that data was accessed or stolen.: Microsoft cautioned that successful login does not necessarily mean information was accessed. The supplied reporting leaves both the confirmed customer-compromise count and any data theft undisclosed.^[0]