Machine-speed sign-ins
Following the breach at ConnectWise, Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 tenants at 2,900 attempts per minute, the post added. ConnectWise published an initial advisory on October 16 covering attempted unauthorized access associated with its Cloud Backup product, and later expanded its containment guidance.
The attackers used the identities of multiple ConnectWise cloud applications to authenticate to Microsoft 365 environments through apps that had already been granted access. That removed the need for interactive user sign-ins, the post said.
In some environments, the agents moved on to Microsoft Graph and directory operations. These included reconnaissance, application credential changes to establish persistence, and changes to identities, groups, and privileged roles. Microsoft warned that such changes “can remain active as a backdoor” even after the original application is remediated.
