Skip to content
securitytabs

LiveUpdated

Microsoft Ties China-Linked Storm-0940 to ConnectWise-Related Attacks on Cloud Tenants

Microsoft says a China-aligned group used stolen ConnectWise credentials and an AI tool to break into customers' Microsoft 365 accounts. Companies whose IT provider uses ConnectWise should ask that provider whether they were affected.

Written by the SecurityTabs AI newsroom from 3 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

Infosecurity Magazine reports that Microsoft has observed threat actor activity in multiple ConnectWise customer environments, with the attackers using an agentic AI platform called ARTEX, meaning software that carries out tasks with little human direction. [1]

The Register reports that Microsoft attributes the activity to a China-aligned group it tracks as Storm-0940, which used compromised ConnectWise application credentials and ARTEX, an open source AI penetration-testing tool, to automate attacks on Microsoft 365 environments. Dark Reading describes the incident as a ConnectWise supply chain attack, meaning an attack that reaches customers through a trusted supplier. [2][3]

Scale

Outlets give slightly different figures. The Register says more than 2,250 Microsoft 365 tenants were targeted, while Dark Reading says more than 2,200 tenants. A tenant is one organization's Microsoft 365 account environment. The articles available do not say how many were successfully compromised. [2][3]

What is not yet known

The articles reviewed do not give detection indicators, a fix, or the data attackers accessed. Readers should consult Microsoft's and ConnectWise's own statements for further detail. [1][2][3]

Timeline

  1. Dark Reading reported Microsoft linked Storm-0940 to a ConnectWise supply chain attack on more than 2,200 tenants. [3]

  2. The Register reported Microsoft attributed the activity to Storm-0940 and said more than 2,250 tenants were targeted. [2]

  3. Infosecurity Magazine reported Microsoft had seen attacker activity in multiple ConnectWise customer environments using ARTEX. [1]

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

If your IT provider uses ConnectWise, its credentials may have been involved, and Microsoft 365 accounts were the reported target. No fix or indicators have been published in the articles reviewed. [2][3]

What to do

  1. Ask your IT provider whether it uses ConnectWise and whether your Microsoft 365 tenant was among those Microsoft flagged. [2]
  2. Watch for notices from Microsoft or your provider about this activity. [1]

Mid-size company

A small IT or security team

What to know

Attackers reportedly used compromised ConnectWise application credentials to reach Microsoft 365 environments, so third-party tools connected to your tenant are part of the exposure. [2]

What to do

  1. Confirm whether ConnectWise products or providers using them have access to your Microsoft 365 tenant. [2][3]
  2. Review which applications and service accounts have access to the tenant, and check for Microsoft notifications. [2][1]

Large enterprise

A security operations team

What to know

Microsoft attributes the activity to Storm-0940 and says it used ARTEX to automate attacks, according to The Register. No indicators were included in the articles reviewed. [2][1]

What to do

  1. Inventory ConnectWise integrations and managed service providers with delegated access to Microsoft 365 tenants. [2][3]
  2. Review audit logs for activity by ConnectWise-linked applications and monitor Microsoft and ConnectWise advisories for indicators. [1][2]

Sources

  1. [1]Infosecurity Magazine · Oct 22, 11:00 UTC
    Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenantscontext
  2. [2]The Register Security · Oct 22, 11:28 UTC
    Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenantscontext
  3. [3]Dark Reading · Oct 22, 20:42 UTC
    Microsoft Links Storm-0940 to ConnectWise Supply Chain Attackcontext