UNKNOWN: Microsoft assesses Storm-0940 responsible for the ConnectWise multi-tenant application compromise; stolen application identities enabled app-only downstream Microsoft 365 tenant authentication and some environments showed Graph/directory follow-on activity.
حد الدليل: Universal tenant compromise, universal data access/exfiltration, final victim denominator, or independently corroborated attribution.
UNKNOWN: Microsoft observed a compromised multi-tenant application reaching downstream Azure environments, enumerating cloud resources and reading secrets across multiple Azure Key Vaults, with key enumeration/unwrapping activity in the incident context.
حد الدليل: Every affected tenant had Key Vault access, all secrets were exfiltrated, or precise prevalence.
UNKNOWN: ConnectWise confirmed unauthorized access to Cloud Backup application identities/credentials, disabled affected application connections and seven identities, revoked certificates and replaced/reset credentials; it requires tenant-by-tenant review and reports no indication stored backup archives were compromised.
حد الدليل: Independent Storm-0940 attribution, compromise of every tenant, or compromise of stored backup archives.
UNKNOWN: Kudelski independently documented abuse of a compromised vendor-held ConnectWise Cloud Backup application credential to obtain Microsoft Graph tokens in customer Entra ID/Microsoft 365 tenants, including related application abuse and persistence through new client secrets/role changes.
حد الدليل: Microsoft actor attribution, final global blast-radius denominator, every consented tenant compromise, or universal exfiltration.
Kudelski Security Research Centerhttps://kudelskisecurity.com/research/connectwise-cloud-backup-formerly-skykick-vendor-credential-abused-against-microsoft-365-tenants