|
Some of the Microsoft 365 tenants caught in the ConnectWise Cloud Backup attack had no active backup subscription at all. What they still had was the consent they had once given the app, and anyone holding the app's compromised credential could use that consent to request a token.
Sophos X-Ops laid out the pattern in a write-up published Monday. The sweep it tracked on Oct. 15 came from a single virtual private server, lasted about 96 minutes and requested one app-only Microsoft Graph token per tenant, moving through tenants in strictly ascending GUID order. Former customers were on the list too, which Sophos said suggests the attacker was working from a full roster of every tenant that had consented to the application. Because the sign-ins used the application's own identity, no user password or MFA prompt was involved.
Microsoft names Storm-0940
Microsoft assessed on Wednesday that Storm-0940, a China-state aligned group active since 2021, was responsible for the compromise. In a detailed post, the company's threat intelligence team said the group used ARTEX, an open-source agentic AI penetration testing framework, to push its usual playbook of password spraying and OAuth application abuse to machine speed. Once it had the ConnectWise app credentials, the group tried to sign in to more than 2,250 tenants at 2,900 attempts per minute, "a pace that leaves defenders with little time to detect and respond," Microsoft wrote. In multiple cases, the time from first targeting to privileged cloud access was under three hours.
ARTEX was linked earlier this month to breaches at South Korean financial firms, and its developer stopped public releases after those hacks came to light. Microsoft said it has now seen threat actors in multiple geographic regions using the framework. It also said the activity did not come from a compromise of, or a vulnerability in, Microsoft's own systems. |
