GoKawiilMicrosoft ties China-linked Storm-0940 group to ConnectWise Cloud Backup breach
Microsoft said the threat actor it tracks as Storm-0940 used compromised application credentials tied to ConnectWise Cloud Backup to try to access more than 2,250 downstream Microsoft 365 customer tenants. In some cases attackers reached privileged cloud access within three hours of targeting, and Microsoft said the group used an agentic AI penetration-testing framework to speed up the campaign. ConnectWise disclosed unauthorized access to its Cloud Backup application identities on Oct. 16 but has not said how attackers first obtained control of them.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident illustrates how attackers can exploit a single managed-service provider's credentials to reach thousands of customer cloud environments at once, turning one breach into a mass supply chain event. Microsoft's researchers suggest the use of agentic AI tools may let threat actors compress reconnaissance and exploitation timelines dramatically, which could make detection and response harder for defenders. The unresolved question of how ConnectWise's credentials were first compromised leaves open whether similar weaknesses exist at other service providers.
- Storm-0940 targeted over 2,250 Microsoft 365 tenants via compromised ConnectWise Cloud Backup credentials.
- Attackers reportedly gained privileged cloud access in under three hours in some cases.
- ConnectWise has not disclosed how the application identities were initially compromised.
YubiKey 5 Series Security Key — Attacks like Storm-0940's credential abuse highlight why phishing-resistant hardware MFA matters for protecting privileged cloud accounts. A YubiKey adds a strong second factor to Microsoft 365 and admin logins, making stolen credentials far less useful to attackers. It's a simple, durable way for IT teams and individuals to harden access to critical cloud infrastructure.
See YubiKey 5 Series Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Jai Vijayan, 2026-10-22
Published there as: “Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.