Search — “connectwise”

Huntress details activity on Oct 15 where a compromised ConnectWise Cloud Backup application credential was used against ~1,000 Huntress-monitored M365 tenants (Microsoft counts 2,250+), attributed by Microsoft to Storm-0940 using the ARTEX AI agent framework. The actor added secrets/certificates to application identities, had the Teams service principal assign itself Global Administrator, granted roles to sibling principals, and deleted the original principal, reaching privileged access in under three hours. Hunt Entra sign-in and directory audit logs for service principals self-assigning privileged roles, credential additions to vendor apps, and vendor apps deviating from baseline user agent (kiota-dotnet) e.g. Python-urllib/3.12, curl/7.88.1, python-requests/2.31 from 144.172.64.x.

Microsoft attributes the ConnectWise Cloud Backup supply chain compromise to China-aligned Storm-0940, which used the ARTEX agentic AI framework to password-spray (151,000+ failures, Oct 10-14) and then abuse stolen ConnectWise app identities to authenticate to 2,250+ M365 tenants from Oct 15. Follow-on Graph activity included reconnaissance, application credential additions for persistence, and privileged role changes (including app self-assignment of Global Administrator). Hunt service-principal sign-ins for the ConnectWise app IDs back to Oct 1, Entra audit for credential/role/consent changes, and the listed IPs and Python/curl user agents.

A stolen ConnectWise Cloud Backup (SkyKick) vendor credential was used from 144.172.64[.]128 to obtain Graph tokens as the app's service principal in ~1,000 Entra tenants (300+ successful) starting Oct 15. In some tenants, ConnectWise Cloud Management service principals self-assigned directory roles (Exchange Admin, Global Admin) and new client secrets were planted on other apps, including an MSP tool and Huntress's app. Hunt Entra service principal sign-ins and audit events for self role assignment, credential additions since Oct 13, and anomalous user agents.