Microsoft names Storm-0940 behind ConnectWise app abuse that reached 2,250 Microsoft 365 tenants
Microsoft said on October 21 that China-aligned Storm-0940 used the ARTEX agentic AI framework and stolen ConnectWise application identities to try signing in to more than 2,250 tenants, in some cases reaching privileged cloud access in under three hours.
Microsoft Threat Intelligence attributed the ConnectWise cloud app compromise on October 21 to Storm-0940, a China-aligned actor active since 2021. From October 10 to 14 the group password-sprayed 327 accounts at eight organizations, logging more than 151,000 failures and peaking near 2,900 per minute, with no successful sign-in. It then switched to the identities of several ConnectWise cloud applications and attempted sign-ins to more than 2,250 Microsoft Entra ID tenants, using permissions customers had already consented to. The activity was driven by ARTEX, an open-source agentic AI penetration testing framework. Microsoft saw Graph reconnaissance, new app credentials for persistence, one management app assigning itself Global Administrator, and bulk secret reads from Azure Key Vault. In several cases targeting to privileged access took under three hours.
Why it matters
The spray failed and the app credential succeeded. That is the gap: user MFA and lockout policy held, while a consented multi-tenant service principal walked in with no prompt at all. Agentic tooling shrinks the time defenders have between consent abuse and a planted backdoor credential.
Follow Microsoft's order of operations. Keep the ConnectWise apps disabled but do not delete them, so evidence survives. Search by application ID, not display name. Review service principal sign-ins back to October 1 where logs exist, separately from user sign-ins. Audit for added credentials, new owners, consent grants and role assignments, then remove what you did not create. Put least privilege on multi-tenant app permissions. Our October 16 post has the app IDs Huntress published.
Source: Microsoft Security Blog
Related on Start with Identity
- BlogPoisoned LiteLLM 1.107.0 shipped a credential stealer to PyPI and Docker for under three hours
LiteLLM said on October 21 that attackers published a malicious litellm 1.107.0 to PyPI, Docker Hub and GHCR, built from a lookalike Berri-AI/litellm repository
- BlogGitLab's incoming email address is a non-expiring token that commits code and runs CI as you
Aikido Security showed that the personal address GitLab issues for creating issues by email can also open merge requests that GitLab commits in your name and ca
- BlogOne actor signed in as Entra ID apps with stolen secrets and reached 27 organizations, Todyl says
Todyl is tracking an ongoing campaign in which one operator uses stolen client secrets to sign in to Microsoft Entra ID as app registrations, reaching 27 organi
- CVECommvault Web Server zero-day that exposed Metallic Microsoft 365 app secrets
An authenticated webshell flaw in Commvault Web Server, used as a zero-day in Commvault's Azure environment, where the actor may have reached client secrets cus
- CVEOver-scoped CodeBuild GitHub token let an attacker ship code in Amazon Q Developer 1.84.0
An inappropriately scoped GitHub token in the CodeBuild configuration for the Amazon Q Developer VS Code extension let an attacker commit code that shipped auto
- CVEtj-actions/changed-files tags repointed to dump CI secrets into logs
An attacker repointed tj-actions/changed-files version tags to a commit that read the GitHub Actions runner's memory and printed its secrets into workflow logs.