ConnectWise Services Remain Offline After Microsoft Flags Storm-0940 Activity

ConnectWise has suspended several of its cloud tools following a warning from Microsoft regarding suspicious activity linked to its platform. The company disabled Cloud Backup, formerly known as SkyKick, along with SaaS Security and Cloud Management as a precaution. A phased restoration plan is currently underway. ConnectWise expects this process to take several days. The company stated it currently has no indicators that partner backup data was compromised.

Microsoft detailed the incident in a recent security blog. The company identified the threat actor as Storm-0940. Microsoft describes Storm-0940 as a China-state-aligned actor. The group has been active since 2021. The campaign targeted a ConnectWise multi-tenant application. This access allowed the group to attempt sign-ins at more than 2,250 Microsoft 365 tenants. The activity did not result from a compromise of Microsoft’s own systems or services.

The attackers utilized stolen application credentials to authenticate. These credentials allowed sign-ins without an interactive user login. Microsoft reported that some attacks reached privileged access in under three hours. The group targeted specific industries. These include aerospace and defense, semiconductors, government, and think tanks. Microsoft listed 14 industries in total as targets.

The campaign involved automated password guessing. This technique, known as password spraying, targeted 327 accounts. These accounts belonged to eight organizations. The attempts generated more than 151,000 failed logons. There were no successful logins via this specific method. At its peak on October 11, the activity reached 2,900 attempts per minute. The total for that day exceeded 111,000 attempts. Almost 98% of this activity was locked out.

A key element of the attack involved a tool called ARTEX. ARTEX is an open-source agentic AI penetration testing framework. It utilizes LLM-driven agents to run an autonomous test. Microsoft stated the use of ARTEX sped up scanning and reconnaissance. It also accelerated password spraying and OAuth application abuse. The agents can operate around the clock. Microsoft noted they require little human interaction. The pace leaves defenders little time to detect and respond.

The use of ARTEX marks a shift from traditional attack methods. Microsoft says the framework can use any AI model. Threat actors in multiple regions are using this technology. Public reporting this month tied it to breaches at South Korean financial institutions. CrowdStrike said the suspect in those attacks was likely based in China. That actor allegedly used ARTEX with Anthropic’s Claude Code. The developer of ARTEX, using the handle Autumn-27, announced the project will become closed source.

Security firm Huntress observed specific actions within one tenant on October 15. An app added itself to the top administrator role. This triggered a Microsoft Defender alert regarding self-assigned Global Administrator roles. Actions included planting new secrets set to expire in 2028. Huntress confirmed unauthorized sign-ins for 162 tenants by October 16. A day later, it observed almost 1,000 Entra tenants with sign-in activity from the attacking IP. More than 300 of those attempts succeeded.

It remains uncertain how the ConnectWise credentials were stolen. It is also unclear how many tenants were actually compromised. Microsoft advises customers to keep affected app connections disabled. Formal restoration instructions will be issued later. Microsoft also advises customers to review activity from this month. This recommendation applies to instances where logs allow for such review.