Microsoft also assesses that Storm-0940 was responsible for the disclosed compromise of a ConnectWise multitenant application. ARTEX is an open-source framework that uses AI agents to automate penetration-testing tasks, according to Microsoft.
How the downstream attacks worked
After gaining control of identities belonging to multiple ConnectWise cloud applications, the group used stolen application credentials to authenticate to Microsoft 365 customer environments where those applications already had access, Microsoft reports. This did not require an interactive user sign-in. In some environments, Microsoft observed subsequent Microsoft Graph and directory activity, including reconnaissance, application credential changes and attempts to modify privileges.
Following the unauthorized ConnectWise access, Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 tenants at 2,900 attempts per minute, according to Microsoft. Separately, during an Oct. 10-14 password-spray campaign against 327 accounts at eight organizations, Microsoft recorded more than 151,000 failed attempts and observed no successful authentication in that campaign. Those figures describe attempted access and failed sign-ins, not a count of breached customers.
Microsoft cautions that an affected application, or even successful threat-actor authentication, does not necessarily mean customer data was accessed or stolen. It says the activity did not result from a compromise or vulnerability in Microsoft systems, products or services. In its Oct. 21 report, Microsoft advised customers to keep affected ConnectWise connections disabled pending formal restoration instructions, preserve evidence, and review application sign-ins and unexpected credential or privilege changes.
