Microsoft Ties ConnectWise Cloud Backup Supply Chain Attack to China-Linked Storm-0940
Microsoft has attributed a supply chain attack involving ConnectWise’s Cloud Backup service to Storm-0940, a threat actor it links to China. According to Dark Reading’s report, the attackers used compromised application credentials tied to the service to attempt access to the Microsoft 365 environments of more than 2,250 downstream customer tenants. Microsoft said most attempts failed, but in a number of cases the actor obtained privileged cloud access within about three hours of first targeting an organization and established persistence.
Microsoft reports that the group used ARTEX, an agentic AI penetration-testing framework, to automate reconnaissance, password spraying and OAuth application abuse, generating as many as 2,900 sign-in attempts per minute. The campaign reportedly began as early as September and targeted hundreds of organizations in sectors including manufacturing, aerospace, chemicals, energy, defense and financial services, with follow-on activity through Microsoft Graph to alter application credentials and privileges.
ConnectWise disclosed unauthorized access to application identities associated with Cloud Backup on 16 October, suspended the service and took related cloud offerings offline. In an update on 22 October it said it was restoring services, that existing backup archives remained encrypted and isolated with no indication of compromise, and that customers should keep affected application connections offline for now. The company has not said how the attackers first obtained the credentials. SecurityWeek and Infosecurity Magazine also covered the incident. Microsoft advises affected organizations to review any tenant tied to ConnectWise and to preserve sign-in, audit and Graph logs before making changes.