Microsoft ties Storm-0940 to ConnectWise backup abuse hitting 2,250 tenants

Key points

• Microsoft attributes the activity to Storm-0940, a group aligned with Chinese state interests.
• The operation involved stolen logins and automated, AI-assisted probing against customer environments.
• ConnectWise Cloud Backup, Microsoft 365 and ARTEX appear in the product context.
• Roughly 2,250 tenants were in the exposure path; no CVE was assigned.

Microsoft has connected a China-linked intrusion cluster known as Storm-0940 to an operation that abused a backup service to reach customer environments. The company describes the actor as working in line with Chinese state priorities. The campaign touched ConnectWise Cloud Backup and Microsoft 365, and ARTEX appears in the associated product set. Rather than relying on a software flaw, the intruders used credentials taken from victims and automated, AI-assisted probing to move at machine speed. No CVE has been assigned to the activity.

About 2,250 tenants were in the exposure path. That number matters because a single compromised integration or backup channel can serve as a bridge into many downstream organizations. The pattern is a supply-chain problem: one weak link can expose many customers, and the targeting is directed at tenants rather than a solitary endpoint. Schools and other Microsoft 365 customers that inherit services through partners should treat third-party backup access as an identity boundary.

Because the activity depends on valid accounts, conventional malware signatures are unlikely to be the main detection. Administrators should look for unusual authentication patterns, new or changed backup roles, and access from unexpected locations. Logs from ConnectWise Cloud Backup, Microsoft 365 and any ARTEX-related tooling should be correlated. The absence of a CVE does not lower the need to act; it shifts the focus from patch management to credential hygiene, integration review and monitoring.

That is why the severity remains medium in the supplied assessment: the event is serious and broad, but it is not tied to an unpatched code defect. The immediate watch items are whether additional tenants are confirmed, whether stolen sessions or tokens remain active, and whether the actor expands from backup access into mail, file or identity control. Organizations should validate their backup restoration paths and confirm that partner-held credentials are not shared across customers.

What to do now

1. Inventory every ConnectWise Cloud Backup integration tied to your Microsoft 365 tenant; disable unused or unknown connections and require reauthorization.
2. Rotate credentials and revoke active sessions or tokens for backup service accounts, then enforce phishing-resistant MFA and least-privilege roles.
3. Restrict backup console and API access to approved IP ranges; alert on new OAuth grants, role changes and logins from unusual locations.
4. Preserve logs from ConnectWise Cloud Backup, Microsoft 365 and ARTEX-related tooling for the incident window, then hunt for anomalous tenant access.
5. Review partner and vendor access agreements; require notification and evidence of credential rotation from any provider holding delegated access.
6. Test restoration from independent backups and verify that backup data is immutable or isolated from production identity controls.
7. Brief help desk and identity teams on Storm-0940 activity and require callback verification for backup-related access requests.

Original source

Security Affairs