Secure ConnectWise Credentials to Prevent Storm-0940 AI-Driven Breaches of 2,250 M365 Tenants

Microsoft has confirmed that the Storm-0940 group compromised application credentials belonging to ConnectWise, granting unauthorized access to more than 2,250 Microsoft 365 tenants. According to Microsoft, these credentials allowed attackers to leverage permissions that customers had previously granted to ConnectWise services, bypassing the need for interactive user authentication.

The risk

The primary risk involves the misuse of existing application permissions. Microsoft states that Storm-0940 utilized an open-source penetration-testing framework called ARTEX, written in Go, to automate reconnaissance, vulnerability discovery, and credential attacks. The group began using this AI-driven tool in September to target global organizations, including government agencies and financial institutions.

Who is exposed

Microsoft says the breach exposed 2,250 Microsoft 365 tenants to unauthorized access. The attackers targeted eight specific organizations between October 10 and 14, executing more than 151,000 failed sign-in attempts against 327 accounts. Microsoft noted no successful logins from this password-spraying phase, but the subsequent use of compromised application identities led to privileged access in some environments within three hours.

Cost and compliance

ConnectWise disabled its Cloud Backup, SaaS Security, and Cloud Management services after discovering unauthorized access to application identities. The vendor did not initially identify the threat actor. Microsoft attributes the activity to Storm-0940, a group Microsoft describes as China-linked and operating since at least 2021. No specific financial losses or regulatory penalties are detailed in the current reports.

Our take on the response

Security teams must immediately inventory all third-party application permissions within their Microsoft 365 tenants. Organizations should verify which services have been granted high-privilege access and reduce those permissions to the minimum necessary. Monitoring for unusual application behavior is essential, as attackers can operate without user interaction.

What defenders should look for

Teams should monitor for anomalous application activity, particularly logins originating from service accounts or API identities rather than human users. Defenders must check for unusual permission escalations or data access patterns that differ from baseline behavior for specific SaaS applications. Alerting on rapid sequences of automated requests can help detect AI-driven reconnaissance. Containment involves temporarily revoking suspicious application tokens and forcing credential resets for affected service identities.

Background: Threat actors

Small businesses must treat threat actors as automated scripts rather than targeted spies. Focus on patching, least privilege, and monitoring. Ask your IT provider about specific detection rules and incident response plans to reduce mean time to detect and limit damage during an intrusion.

Read the full guide: Threat Actors: Practical Defense Strategies for Small Businesses

What to do and how to stay safe: Microsoft 365

• Review all OAuth application consents and remove access for any third-party tools that are no longer in use or have suspicious permission scopes.
• Enable advanced logging for application sign-ins to detect non-interactive access patterns that bypass standard multi-factor authentication checks.
• Implement conditional access policies that restrict application logins to specific IP ranges or require additional verification for high-privilege actions.
• Monitor for sudden spikes in failed authentication attempts, which may indicate automated scanning or password-spraying campaigns targeting your environment.

Step-by-step guide: Multi-Factor Authentication Fatigue: Why Users Click Yes Too Fast

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did the attackers use stolen user passwords to access the tenants?

Microsoft observed no successful logins from the password-spraying campaign, but attackers used compromised ConnectWise application identities to bypass user login requirements.

What tool did Storm-0940 use to automate the attacks?

The group used ARTEX, an open-source AI penetration-testing framework written in Go that automates reconnaissance, vulnerability discovery, and data theft.

How quickly did the attackers gain privileged access?

In some environments, Microsoft says the attackers went from selecting a target to gaining privileged cloud access in less than three hours.