Storm-0940 used AI agents to abuse ConnectWise apps, Microsoft says

Oct 22, 6:00 a.m. ET

Microsoft says Storm-0940, a China-state aligned group active since 2021, was behind the abuse of ConnectWise’s Microsoft 365 apps. The group used ARTEX, an open-source framework of AI agents, to speed it up. After taking control of the apps’ identities, the group tried to sign in to more than 2,250 tenants at 2,900 attempts a minute. In some tenants it went on to change app credentials, identities and privileged roles, changes that can outlast disabling the app.

Microsoft says Storm-0940 has used ARTEX since at least September against hundreds of organizations, from aerospace and defense to government and think tanks. Sometimes it reached privileged cloud access in under three hours. ARTEX is a penetration testing framework whose AI agents can run an attack from reconnaissance to data theft with little human input. The group has long got in through password spraying and internet-facing applications, Microsoft says.

Between Oct 10 and 14, the group’s address sprayed passwords at 327 accounts in eight organizations, with more than 151,000 failed sign-ins and no success. ConnectWise later added the same address to its advisory’s indicators. In tenants it reached through the apps, Microsoft saw Microsoft Graph reconnaissance, app credential changes for persistence, and changes to identities, groups and privileged roles.

Microsoft says the activity didn’t come from a compromise of, or a flaw in, its own systems or products. An affected app, or even a successful sign-in, doesn’t by itself mean data was accessed or taken, it says. Its Defender XDR and Defender for Cloud Apps detections and hunting queries cover the activity.

Microsoft hasn’t said how the group took control of the ConnectWise apps’ identities or how many tenants it changed. Its guidance refers to four application IDs, but its hunting queries list three.

Vendors: ConnectWise, Microsoft
Log retention: 7 days on Entra ID Free, 30 days on P1 and P2

What to do

8 steps

1Keep affected ConnectWise app connections disabled until ConnectWise gives formal restoration instructions, and don’t delete the enterprise applications as the first response.
2Look for the ConnectWise app IDs in the indicators in every Microsoft 365 tenant where they are or were authorized, searching by app ID rather than display name.
3Preserve Entra sign-in and audit records, Purview Audit records, SIEM data and Microsoft Graph telemetry, without delaying urgent containment while waiting for exports.
4Review service principal sign-ins from at least Oct 15, and back to Oct 1 where records allow, looking at successful and failed sign-ins separately.
5Investigate unfamiliar sources outside the vendor’s expected infrastructure, without limiting the review to the published IP addresses.
6Check Entra audit records for new app credentials, owners, role assignments and consent grants, and for changes to users, groups, authentication methods or Conditional Access.
7Check Microsoft 365 audit records for reconnaissance from unusual IP addresses, and for unusual mail or file access, forwarding, inbox rules or mailbox permissions.
8After preserving evidence, have an authorized responder remove confirmed unauthorized credentials, grants, owners, assignments and identities.

Indicators

IPs copy defanged. Use Copy raw for queries.

Type	Value	Note
App ID		ConnectWise Cloud Backup app
App ID		ConnectWise MS Teams app
App ID		ConnectWise MS Graph app
IP address		Sign-ins and Graph activity through ConnectWise apps
IP address		Sign-ins and Graph activity, and the Oct 10–14 password spray
IP address		Sign-ins and Graph activity through ConnectWise apps
IP address		VPN address using the apps, relevant only on Oct 15–16
IP address		VPN address using the apps, relevant only on Oct 15–16
IP address		VPN address using the apps, relevant only on Oct 15–16
User agent		Seen in sign-ins and Graph activity through the apps
User agent		Seen in sign-ins and Graph activity through the apps
User agent		Seen in sign-ins and Graph activity through the apps
User agent		Seen in sign-ins and Graph activity through the apps
User agent		Seen in sign-ins and Graph activity through the apps

App IDConnectWise Cloud Backup app
App IDConnectWise MS Teams app
App IDConnectWise MS Graph app
IP addressSign-ins and Graph activity through ConnectWise apps
IP addressSign-ins and Graph activity, and the Oct 10–14 password spray
IP addressSign-ins and Graph activity through ConnectWise apps
IP addressVPN address using the apps, relevant only on Oct 15–16
IP addressVPN address using the apps, relevant only on Oct 15–16
IP addressVPN address using the apps, relevant only on Oct 15–16
User agentSeen in sign-ins and Graph activity through the apps
User agentSeen in sign-ins and Graph activity through the apps
User agentSeen in sign-ins and Graph activity through the apps
User agentSeen in sign-ins and Graph activity through the apps
User agentSeen in sign-ins and Graph activity through the apps

Timeline

Oct 10–14Storm-0940 sprays passwords at 327 accounts in eight organizations without success, Microsoft says.
Oct 15The group signs in to customer tenants through the ConnectWise apps, and public reports of the compromise begin.
Oct 16ConnectWise publishes its first advisory on the unauthorized access.
Oct 21Microsoft attributes the attack to Storm-0940 and publishes detections, hunting queries and new indicators.

Sources

Microsoft researchPrimary source microsoft.com
ConnectWise noticePrimary source status.connectwise.com
Microsoft Entra data retention pagePrimary source learn.microsoft.com

Storm-0940 used AI agents to abuse ConnectWise apps, Microsoft says

What to do

Indicators

Timeline

Sources

Tags

Get the Daily Brief by email