Summary Points
- China-aligned Storm-0940 used ARTEX to automate attacks against hundreds of organizations, reaching privileged cloud access in some cases in under three hours.
- The actor abused compromised ConnectWise OAuth applications to access Microsoft 365 without interactive user sign-ins, then used Graph for reconnaissance and credential or privilege changes.
- A password-spraying campaign generated 151,000+ failed sign-ins; despite no successful logins in that campaign, related supply-chain abuse enabled follow-on activity in customer environments.
Threat, Techniques, and Targets
Storm 0940, a China aligned actor, used ARTEX, an AI driven penetration testing framework, to automate attacks against hundreds of organizations worldwide. Microsoft attributes the ConnectWise Cloud Backup supply chain compromise to Storm 0940.
The actor used scanning, reconnaissance, password spraying, and OAuth application abuse. It also used compromised application credentials to access customer Microsoft 365 environments without an interactive user sign in. In some environments, the actor used Microsoft Graph to explore resources, change application credentials, and attempt to gain higher privileges.
Targets spanned sectors such as government, finance, energy, manufacturing, technology, defense, and aerospace. Several attacks led to privileged cloud access, sometimes in less than three hours. However, most targeting attempts did not succeed.
Impact, Security Implications, and Remediation
Compromised third party applications can expose customer environments to unauthorized access and lasting persistence. However, an affected application or successful sign in does not prove that an attacker accessed or stole customer data. Microsoft says the activity did not result from a compromise or vulnerability in its corporate systems, products, or services.
Therefore, organizations should:
- Keep affected ConnectWise application connections disabled until ConnectWise provides restoration instructions.
- Review current and past Microsoft 365 application connections by application ID. Check service principal sign ins, Microsoft Graph activity, and audit records for unusual access or changes.
- Preserve relevant sign in, audit, and security records before making irreversible changes. Do not delete enterprise applications as a first response.
- Investigate unexpected credential additions, permission grants, privilege changes, and access to mail or files. For confirmed suspicious activity, remove unauthorized access and rotate credentials.
- Apply least privilege to multi tenant application permissions. Also, confirm that vendor credential rotation and tenant remediation removed any remaining unauthorized access.
- Assess effects on backup and restore workflows, and follow ConnectWise’s current guidance.
Microsoft Defender XDR offers detections and hunting queries for suspicious sign ins and Microsoft Graph activity. Since automated attacks can move quickly, investigate alerts promptly and coordinate containment.
Discover More Technology Insights
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Stay inspired by the vast knowledge available on Wikipedia.
ThreatIntel-V1
