Storm-0940 uses AI and a ConnectWise application to get into Microsoft 365 tenants
Microsoft attributes to Storm-0940 a campaign that used already-authorised identities of the ConnectWise Cloud Backup application to enter Microsoft 365 tenants.
What happened
Microsoft attributes the campaign to Storm-0940, a China-aligned actor. The group compromised the ConnectWise Cloud Backup application and used its application identities, which were already authorised in the tenants, to get in without any user sign-in. To widen the reach it used ARTEX, a system of several AI agents, with which it attempted to access more than 2,250 tenants; in some cases it achieved privileged access in under three hours. ConnectWise published its first advisory on 16 October.
Why it matters
Access did not come from a stolen password but from trust that had already been granted: the supplier application was authorised inside the customer and nobody had to approve anything at the time of the attack. Once inside, the group changed credentials for applications, groups and privileged roles. Those changes can keep working as a back door even after the original application is fixed, so updating ConnectWise alone does not close the problem. The fact that a system of AI agents accelerated the work explains a pace no human team reviewing tenant after tenant could keep up.
What we recommend
Review third-party application permissions in Microsoft 365, the credentials added to applications and recent changes in roles and groups. Any permission or credential nobody authorised is an indicator to be treated as an incident, not as a setting that gets corrected and forgotten. It is worth doing the same for applications that were set up months ago and that nobody has reviewed since.
Related service: respuesta-incidentes · soc-gestionado
Want to know how it affects you?
We review your environment and tell you what to prioritise, with no commitment.