We need answer only headline <=90 chars, new factual, no five-word sequence external. Need craft. Facts: Storm-0940 China-aligned, Microsoft

En bref

• Storm-0940, assessed as China-aligned, compromised a backup supply chain to reach Microsoft 365 tenants.
• About 2,250 tenants were exposed through stolen credentials and targeted access.
• The group used AI-assisted pentesting and high-speed exploitation; no CVE was involved.
• Admins should rotate credentials, review backup integrations, and enforce MFA.

Microsoft and ConnectWise are dealing with an intrusion campaign tied to Storm-0940, a group assessed as China-aligned. The activity involved ConnectWise Cloud Backup, Microsoft 365 and the ARTEX component, and it produced a supply-chain compromise that enabled credential theft and focused access against tenant environments. The reported scope is approximately 2,250 tenants. No CVE has been assigned, so this is not a patch-one-bug scenario.

Organizations that depend on third-party backup services for Microsoft 365 are the most exposed. A backup platform often holds privileged, persistent access to mailboxes, files and directory data, which makes it an attractive stepping stone. For school districts, the practical risk is account takeover, data exposure and disruption to recovery operations if backup credentials or integration roles are abused.

The actor’s tradecraft stands out for speed. Reporting points to AI-assisted pentesting and machine-speed attacks, meaning attempts can be automated and adjusted faster than manual review cycles. Credential exploitation is central: stolen or weakly protected identities give the intruders a way into tenants without relying on a software vulnerability. That makes identity hygiene, logging and third-party app governance more important than patch status alone.

Microsoft and ConnectWise are the vendors to watch for updated guidance and indicators. Administrators should treat the event as a supply-chain trust issue, not just a backup-product issue. Review which accounts and applications can reach tenant data through backup integrations, confirm MFA and conditional access coverage, and look for anomalous consent grants, mailbox rule changes, service-account logins and high-rate authentication attempts. Severity is medium, but the blast radius can grow if credentials remain valid.

À faire maintenant

1. Immediately rotate credentials and revoke active sessions for accounts tied to ConnectWise Cloud Backup and ARTEX integrations; enforce MFA on all related identities.
2. Audit the Microsoft 365 tenant for unusual OAuth grants, service principals, mailbox rules and backup application permissions; remove anything unused or unrecognized.
3. Review ConnectWise Cloud Backup configuration and access logs for unauthorized activity, and apply any vendor-provided mitigations or guidance.
4. Restrict backup service accounts to least privilege, separate administrative accounts from daily-use identities, and block legacy authentication.
5. Enable alerting for high-volume authentication attempts, impossible travel, new application consents and changes to backup or recovery roles.
6. Because no CVE is associated with this campaign, prioritize identity, logging and third-party integration controls over patch-only response.
7. Report suspicious tenant activity to Microsoft and ConnectWise, and preserve logs for incident review.

Source originale

Security Affairs