thehackernews.com • 2h
ConnectWise Cloud Backup Credential Compromise Exposes Microsoft 365 Tenants
China-linked threat actor Storm-0940 abused stolen ConnectWise Cloud Backup application credentials to authenticate into Microsoft 365 tenants via non-interactive Microsoft Graph token issuance. The compromised service principal held broad permissions across Exchange Online, OneDrive, SharePoint, and Teams, enabling MFA and conditional access bypass. Attackers leveraged the ARTEX agentic AI framework to conduct approximately 2,900 sign-in attempts per minute, targeting over 2,250 tenants with confirmed access in 173. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management and disabled seven application identities.