Microsoft links Storm-0940 to ConnectWise attack targeting 2,250 Microsoft 365 tenants
Microsoft attributed the ConnectWise supply-chain attack to Storm-0940, a China-aligned threat actor that used the ARTEX AI framework to automate reconnaissance, password spraying and OAuth application abuse. Microsoft said the campaign reached more than 2,250 tenants and that some attacks progressed to privileged cloud access in under three hours; it has not said how many customers were compromised or whether data was stolen.
Bottom line — Microsoft says some ARTEX-driven attacks reached privileged cloud access in under three hours.
Go deeper 7
-
Microsoft observed more than 151,000 failed logons against 327 accounts across eight organisations between 10 and 14 October.
-
Microsoft reported 2,900 sign-in attempts per minute during the campaign.
-
CyberScoop reported that ConnectWise temporarily shut down services and began restoring them in phases, advising customers to keep connections disabled.
-
Microsoft said attackers modified application credentials and made changes involving identities, groups and privileged roles in some environments.
-
Cyber Security News cited earlier reporting that unauthorised sign-ins affected 173 tenants; that figure counts reported access, not Microsoft’s broader targeting total.
-
Microsoft said successful authentication does not necessarily mean attackers accessed or stole data.
-
Microsoft said the activity did not stem from a vulnerability or compromise in its own products or services.