Storm-0940 used ConnectWise access to enter Microsoft 365 tenants
Microsoft attributed the ConnectWise Cloud Backup supply-chain compromise to Storm-0940, which used ARTEX in attacks against more than 2,250 Microsoft 365 tenants. Microsoft says the AI-driven penetration-testing framework accelerated the campaign.
Rather than signing in as a person, the attackers used applications customers had already authorized to connect to Microsoft 365, avoiding a new interactive sign-in. Microsoft observed follow-on activity through Microsoft Graph, including reconnaissance, application credential changes, and attempts to modify privileges.
For organizations using ConnectWise Cloud Backup, containing the supplier alone may not settle whether access or privileges were changed inside their own tenant. Microsoft says an affected application or successful authentication does not by itself show that customer data was accessed or taken.
Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group
Storm-0940 used the agentic AI penetration testing framework to automate attacks and “reach more than 2,250 tenants at 2,900 sign-in attempts per minute,” Microsoft researchers said.
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise | Microsoft Security Blog
Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments.