Microsoft says Storm-0940 was responsible for recently disclosed Connectwise supply chain compromise
MSFT•Microsoft assessed that China-aligned Storm-0940 was responsible for a recently disclosed Connectwise supply chain compromise involving a multi-tenant application. Microsoft said the group used an AI framework to automate attacks on hundreds of organizations and that data access in multiple customer environments was not confirmed.
1. Microsoft’s assessment
Microsoft said Storm-0940 used the AI framework Artex to automate attacks on hundreds of organizations globally, achieving privileged cloud access in less than three hours in multiple instances. The company said a password-spraying campaign targeted 327 accounts across eight organizations from October 10 to 14, and that authentication activity was detected in multiple customer environments, though data access was not confirmed. Microsoft also said Storm-0940 has used OAuth applications to access and exfiltrate email and other data through Microsoft Graph.
