Microsoft links Storm-0940 to attacks on 2,250 tenants

Microsoft says the China-linked hacking group it tracks as Storm-0940 used the ARTEX artificial-intelligence framework and credentials stolen from ConnectWise to target more than 2,250 Microsoft 365 tenants. The campaign combined automated reconnaissance and authentication attempts with efforts to gain privileged cloud access, according to Microsoft, which said most targeting was unsuccessful. Microsoft reported that the attackers made up to 2,900 sign-in attempts per minute against the tenants, using identities associated with ConnectWise Cloud Backup applications that already had permission to access Microsoft 365 environments. The method allowed attempts without interactive sign-ins by users. In some cases, Microsoft said, Storm-0940 gained privileged cloud access less than three hours after first targeting an organization. The software provider said the campaign did not result from a compromise of, or vulnerability in, Microsoft’s own systems, products or services. It cautioned that the presence of an affected application or even a successful authentication does not by itself establish that attackers accessed or stole data. Microsoft said the majority of targeting failed,...