Microsoft ties ConnectWise tenant attack to China-linked group
The 2,250 figure counts organizations the attackers tried to enter. How many were actually accessed is still unanswered.
Microsoft is blaming Storm-0940, a group it links to the Chinese state, for login attempts against more than 2,250 Microsoft 365 tenants after the ConnectWise breach, according to a Microsoft Threat Intelligence report published Oct. 21. A tenant is each organization's own space inside Microsoft 365.
The number counts attempts, not hacked companies. Microsoft has not said how many were actually accessed, and it cautions that a successful sign-in does not "necessarily indicate" that customer data was taken.
The attackers authenticated with credentials from ConnectWise applications, using permissions customers had already granted. To automate the effort they turned to ARTEX, an open penetration-testing tool that uses AI agents. There is no CVE: the attack abuses credentials and OAuth applications, not a software flaw. Microsoft says its own systems were not compromised.
The report measures:
- A peak of 2,900 failed sign-in attempts per minute on Oct. 11.
- In several cases, under three hours between picking a target and holding privileged access.
- A separate password-spraying campaign, which tries a few passwords across many accounts, ran Oct. 10 to 14. It hit 327 accounts at eight organizations with more than 151,000 failed attempts, and not a single successful login.
A different figure circulates separately: security firm Huntress confirmed at least 162 compromised tenants among its own customers. That is one company's count, not the total.
ConnectWise found on Oct. 17 that someone had gained unauthorized access to its application identities, and shut down Cloud Backup, the service formerly known as SkyKick. The next day it disabled seven identities and suspended two more services, SaaS Security and Cloud Management. Its notice to partners says stored backups remain encrypted and isolated and that nothing suggests they were compromised. ConnectWise has not confirmed the state-actor attribution, and an outside forensic firm is still working out how the attacker got in.
For tenant administrators, and for anyone who relies on a managed service provider using ConnectWise, Microsoft recommends searching by ID for the three applications it names: MS Graph (ID 0de14c77-b9b0-4137-9360-34878a929827), Cloud Backup (ID 506e08f9-6e9a-4da4-942b-a099a03644ae) and the Teams app (ID 24205314-2b89-4e07-a2a4-579e898a5640), in every environment where they were ever authorized. It also asks for a review of service principal sign-ins from Oct. 15 at the least, ideally from Oct. 1, plus any new credentials, roles or consents. Its own text mentions four applications and lists only three.
No source reports affected organizations in Mexico. ConnectWise has set Oct. 26 as its target to restore backups, pending validation, with full re-enrollment to follow.
