سجل تدقيق مستقل يربط نتيجة البحث بالأدلة والتناقضات وحالة الالتزام والـReadback والمتابعة دون استنتاج حالة غير مسجلة.
Canonical Run ID
ACRIP-CSS-20261101-001
ناجح · PASS
What ran?GENERAL_DISCOVERY
Discover and select the highest-value current Cloud/SaaS security development; initialize CY-DOM-005 if needed; execute verification, contradiction/negative-space, identity/dedupe, canonical commit, Hot-Start refresh and closure.
Candidate board selected ConnectWise/Storm-0940 over newer vulnerability-only cloud candidates because real exploitation, multi-tenant trusted-application abuse and downstream control-plane/secret access are evidenced. CSS initialized; UNKNOWN preserved for per-tenant impact, initial root cause and independent attribution.
EVIDENCE
الأدلة وما تثبته
4 سجل
CSS-E-0001
Microsoft assesses Storm-0940 responsible for the ConnectWise multi-tenant application compromise; stolen application identities enabled app-only downstream Microsoft 365 tenant authentication and some environments showed Graph/directory follow-on activity.
UNKNOWN
Supports
Trusted-application compromise, downstream authentication, and observed control-plane activity in some environments.
Does not prove
Universal tenant compromise, universal data access/exfiltration, final victim denominator, or independently corroborated attribution.
Confidence
غير مسجل
Context
ConnectWise Cloud Backup / Microsoft 365 / service principals
Microsoft Security Research / Microsoft Threat Intelligenceفتح المصدرCY-T1 / Provider Primary Threat Intelligence
CSS-E-0002
Microsoft observed a compromised multi-tenant application reaching downstream Azure environments, enumerating cloud resources and reading secrets across multiple Azure Key Vaults, with key enumeration/unwrapping activity in the incident context.
UNKNOWN
CONTRADICTIONS
التناقضات والقيود
لا توجد تناقضات مسجلة لهذه الجولة.
UNCERTAINTY
الفجوات غير المحسومة
{"Notes":"Successful auth ≠ data access; preserve UNKNOWN per tenant without logs.","Gap ID":"CSS-GAP-001","Impact":"Blocks prevalence/universal-impact claims and precise systemic loss estimates.","Status":"OPEN","Gap Type":"BLAST_RADIUS_DENOMINATOR","Priority":"HIGH","Domain ID":"CY-DOM-005","Topic IDs":"CY-TOP-CSS-001","Description":"Exact number of downstream tenants with unauthorized authentication, material control-plane change, cloud-secret access, or confirmed data exfiltration is not established by current primary evidence.","Last Reviewed":"2026-11-01","Resolution Run":"","Required Evidence / Resolution":"Tenant-level service-principal sign-ins, Graph/audit activity, Key Vault logs, IR outcomes and an authoritative denominator."}
{"Notes":"Do not infer vulnerability exploitation or misconfiguration without evidence.","Gap ID":"CSS-GAP-002","Impact":"Blocks definitive vendor-layer root-cause and preventability claims.","Status":"OPEN","Gap Type":"INITIAL_ACCESS_ROOT_CAUSE","Priority":"HIGH","Domain ID":"CY-DOM-005","Topic IDs":"CY-TOP-CSS-001,CY-DOM-007","Description":"The exact initial path by which ConnectWise Cloud Backup application identities/credentials were compromised is not fully established in public primary evidence recovered in this Run.","Last Reviewed":"2026-11-01","Resolution Run":"","Required Evidence / Resolution":"Vendor forensic root-cause disclosure, credential issuance/audit timeline, IdP logs, build/secret-management provenance."}
FOLLOW-UP
المتابعات غير المحسومة
0 مفتوحة
لا توجد متابعة OPEN أو PLANNED لهذه الجولة.
AUDIT TIMELINE
السجل الزمني الكامل
0 حدث
لا توجد run_events تاريخية لهذه الجولة؛ تُعرض حالات Lifecycle أعلاه كما هي من سجل Run ولا يتم اختلاق أحداث بديلة.
Observed downstream cloud-secret and control-plane impact in multiple environments.
Does not prove
Every affected tenant had Key Vault access, all secrets were exfiltrated, or precise prevalence.
Confidence
غير مسجل
Context
Azure Key Vault / workload identity / service principal
Microsoft Security Research / Microsoft Threat Intelligenceفتح المصدرCY-T1 / Provider Primary Threat Intelligence
CSS-E-0003
ConnectWise confirmed unauthorized access to Cloud Backup application identities/credentials, disabled affected application connections and seven identities, revoked certificates and replaced/reset credentials; it requires tenant-by-tenant review and reports no indication stored backup archives were compromised.
Kudelski independently documented abuse of a compromised vendor-held ConnectWise Cloud Backup application credential to obtain Microsoft Graph tokens in customer Entra ID/Microsoft 365 tenants, including related application abuse and persistence through new client secrets/role changes.
UNKNOWN
Supports
Independent technical corroboration of vendor-held credential/OAuth service-principal abuse and persistence mechanisms.
Does not prove
Microsoft actor attribution, final global blast-radius denominator, every consented tenant compromise, or universal exfiltration.
Confidence
غير مسجل
Context
ConnectWise Cloud Backup / Entra ID / Microsoft Graph
Kudelski Security Research Centerفتح المصدرCY-T2 / Independent Security Research
{"Notes":"Keep attribution source-qualified.","Gap ID":"CSS-GAP-003","Impact":"Blocks treating attribution as independently established fact.","Status":"OPEN","Gap Type":"ATTRIBUTION_INDEPENDENCE","Priority":"MEDIUM-HIGH","Domain ID":"CY-DOM-005","Topic IDs":"CY-TOP-CSS-001,CY-DOM-008","Description":"Microsoft attributes the ConnectWise compromise to Storm-0940, but independent authoritative forensic corroboration was not recovered.","Last Reviewed":"2026-11-01","Resolution Run":"","Required Evidence / Resolution":"Independent IR/provider/government attribution with actor-linked infrastructure or operational artifacts."}
{"Notes":"Static IOC overlap alone is insufficient.","Gap ID":"CY-GAP-0802","Impact":"Blocks durable infrastructure ownership and cross-campaign continuity claims.","Status":"OPEN","Gap Type":"INFRASTRUCTURE_PROVENANCE_CONTINUITY","Priority":"HIGH","Domain ID":"CY-DOM-008","Topic IDs":"CY-TOP-0801,CY-TOP-AIS-001,CY-TOP-CSS-001","Description":"Public evidence does not fully resolve ownership/control, compromise state and first/last-seen continuity for ARTEX controllers, proxies and campaign C2 across clusters.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-TAI-20261101-001","Required Evidence / Resolution":"Passive DNS, RDAP/WHOIS history, CT, provider logs and time-bounded controller artifacts."}
{"Notes":"Strong mechanism/guidance does not establish causal population-level effectiveness.","Gap ID":"CY-GAP-IAS-7C4A91D2-02","Impact":"Blocks population-risk and generalized control-effectiveness claims.","Status":"OPEN","Gap Type":"PREVALENCE_CONTROL_EFFECTIVENESS","Priority":"HIGH","Domain ID":"CY-DOM-004","Topic IDs":"CY-TOP-IAS-7C4A91D2,CY-TOP-CSS-001","Description":"No representative denominator or controlled multi-environment dataset quantifies prevalence or comparative effectiveness of phishing-resistant MFA/device-bound passkeys, managed-device CA, device-code restrictions and strict security-info registration.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-IAS-20261101T100800Z-7C4A91D2","Required Evidence / Resolution":"Representative tenant/sector denominator plus normalized control deployment and before/after outcomes."}
NEW — actual multi-tenant application-identity compromise and downstream control-plane activity verified. Universal tenant impact, exact blast radius, initial credential-compromise root cause and independent actor attribution remain UNKNOWN/open.