ConnectWise Credential Attack Changed Tools in 55 Seconds

A ConnectWise credential attack on Microsoft 365 tenants changed tools within 55 seconds of a failed certificate upload. Huntress saw retries added in the next run, but also saw a separate loop keep firing for 22 minutes after its target Teams service principal was deleted. Microsoft attributes the campaign to Storm-0940 using ARTEX; Huntress rates AI involvement low-to-medium confidence from its own logs and medium-to-high when it includes Microsoft’s attribution. Hunt additions of application credentials and privileged roles even when request pacing changes.

A stolen vendor-held credential obtained app-only tokens in consenting tenants. In two tenants Huntress examined, a Teams application granted itself Global Administrator and added credentials to other applications. Disabling the first connection leaves those planted credentials to investigate. Microsoft also reports Key Vault secret reads through a compromised app; investigate relevant Azure access without assuming every tenant was affected. Microsoft says the actor attempted sign-ins to more than 2,250 tenants; attempted access and successful authentication alone are not measures of stolen data.

Inventory ConnectWise’s seven listed app IDs across current and formerly authorized tenants, including Cloud Backup 506e08f9-6e9a-4da4-942b-a099a03644ae, Teams 24205314-2b89-4e07-a2a4-579e898a5640 and MS Graph 0de14c77-b9b0-4137-9360-34878a929827. Preserve and review service-principal sign-ins from October 15, extending to October 1 where available; correlate with Entra credential additions, app-role and privileged-role grants, and available Graph activity logs. Use 144.172.64[.]128 as one pivot, then investigate unfamiliar sources too. Keep affected connections disabled pending ConnectWise restoration instructions; remove confirmed unauthorized credentials and grants, rotate affected credentials, and verify surviving credentials and roles have approved owners before restoring the integration.