Microsoft names Storm-0940 behind ConnectWise app abuse that reached 2,250 Microsoft 365 tenants

Microsoft Threat Intelligence attributed the ConnectWise cloud app compromise on October 21 to Storm-0940, a China-aligned actor active since 2021. From October 10 to 14 the group password-sprayed 327 accounts at eight organizations, logging more than 151,000 failures and peaking near 2,900 per minute, with no successful sign-in. It then switched to the identities of several ConnectWise cloud applications and attempted sign-ins to more than 2,250 Microsoft Entra ID tenants, using permissions customers had already consented to. The activity was driven by ARTEX, an open-source agentic AI penetration testing framework. Microsoft saw Graph reconnaissance, new app credentials for persistence, one management app assigning itself Global Administrator, and bulk secret reads from Azure Key Vault. In several cases targeting to privileged access took under three hours.

Why it matters

The spray failed and the app credential succeeded. That is the gap: user MFA and lockout policy held, while a consented multi-tenant service principal walked in with no prompt at all. Agentic tooling shrinks the time defenders have between consent abuse and a planted backdoor credential.

Follow Microsoft's order of operations. Keep the ConnectWise apps disabled but do not delete them, so evidence survives. Search by application ID, not display name. Review service principal sign-ins back to October 1 where logs exist, separately from user sign-ins. Audit for added credentials, new owners, consent grants and role assignments, then remove what you did not create. Put least privilege on multi-tenant app permissions. Our October 16 post has the app IDs Huntress published.

Source: Microsoft Security Blog