TOPIC
ConnectWise Cloud Backup application-identity compromise, downstream Microsoft 365/Azure trusted-application abuse, service-principal/OAuth persistence, cloud-secret access, blast-radius boundaries, attribution and remediation.
1
4
5
4
3
NEW — actual multi-tenant application-identity compromise and downstream control-plane activity verified. Universal tenant impact, exact blast radius, initial credential-compromise root cause and independent actor attribution remain UNKNOWN/open.
CLOUD_SAAS_INCIDENT_RESEARCH_TOPIC
—
—
—
Compromise of a trusted multi-tenant SaaS application identity can provide app-only downstream tenant access without an interactive user sign-in, within pre-granted permissions.
Per-tenant scope and permissions actually exercised
In at least some affected downstream environments, trusted-application abuse progressed beyond authentication to Graph/directory operations, persistence changes and cloud-secret access.
Affected-tenant denominator; per-tenant objects/secrets accessed; exfiltration evidence
All tenants with an affected ConnectWise application experienced unauthorized data access or exfiltration.
BLAST_RADIUS_DENOMINATOR
INITIAL_ACCESS_ROOT_CAUSE
مرجع SSOT مسجل، لكن الرابط الداخلي مخفي حتى تفعيل حماية Admin.
Related Topics
Related Domains
الإجمالي: 4 Evidence
Microsoft assesses Storm-0940 responsible for the ConnectWise multi-tenant application compromise; stolen application identities enabled app-only downstream Microsoft 365 tenant authentication and some environments showed Graph/directory follow-on activity.
لا يثبت: Universal tenant compromise, universal data access/exfiltration, final victim denominator, or independently corroborated attribution.
فتح Run المصدرMicrosoft observed a compromised multi-tenant application reaching downstream Azure environments, enumerating cloud resources and reading secrets across multiple Azure Key Vaults, with key enumeration/unwrapping activity in the incident context.
لا يثبت: Every affected tenant had Key Vault access, all secrets were exfiltrated, or precise prevalence.
فتح Run المصدرConnectWise confirmed unauthorized access to Cloud Backup application identities/credentials, disabled affected application connections and seven identities, revoked certificates and replaced/reset credentials; it requires tenant-by-tenant review and reports no indication stored backup archives were compromised.
لا يثبت: Independent Storm-0940 attribution, compromise of every tenant, or compromise of stored backup archives.
فتح Run المصدرKudelski independently documented abuse of a compromised vendor-held ConnectWise Cloud Backup application credential to obtain Microsoft Graph tokens in customer Entra ID/Microsoft 365 tenants, including related application abuse and persistence through new client secrets/role changes.
لا يثبت: Microsoft actor attribution, final global blast-radius denominator, every consented tenant compromise, or universal exfiltration.
فتح Run المصدرTenant-by-tenant forensic results and reliable denominator
Storm-0940 is the actor responsible for the ConnectWise Cloud Backup supply-chain compromise.
Independent actor-linked forensic or authoritative attribution
Exact number of downstream tenants with unauthorized authentication, material control-plane change, cloud-secret access, or confirmed data exfiltration is not established by current primary evidence.
Tenant-level service-principal sign-ins, Graph/audit activity, Key Vault logs, IR outcomes and an authoritative denominator.
The exact initial path by which ConnectWise Cloud Backup application identities/credentials were compromised is not fully established in public primary evidence recovered in this Run.
Vendor forensic root-cause disclosure, credential issuance/audit timeline, IdP logs, build/secret-management provenance.
Microsoft attributes the ConnectWise compromise to Storm-0940, but independent authoritative forensic corroboration was not recovered.
Independent IR/provider/government attribution with actor-linked infrastructure or operational artifacts.
Public evidence does not fully resolve ownership/control, compromise state and first/last-seen continuity for ARTEX controllers, proxies and campaign C2 across clusters.
Passive DNS, RDAP/WHOIS history, CT, provider logs and time-bounded controller artifacts.
No representative denominator or controlled multi-environment dataset quantifies prevalence or comparative effectiveness of phishing-resistant MFA/device-bound passkeys, managed-device CA, device-code restrictions and strict security-info registration.
Representative tenant/sector denominator plus normalized control deployment and before/after outcomes.
ATTRIBUTION_INDEPENDENCE