Discovered on Oct 14, disclosed on Oct 16, attributed by Microsoft on Oct 21. Most targets were not successfully compromised, but several attacks gained privileged cloud access, some in under 3 hours from first targeting to privileged access. Microsoft gave no count of successes.
Confirmed victims
ConnectWise (Cloud Backup)
162 tenants confirmed by Huntress
Targets
2,250+ M365 tenants (attempted sign-in)
327 accounts at 8 organizations (password spraying, no success observed)
Attribution
ARTEX basis
Microsoft says Storm-0940 used ARTEX for automation but does not explain how it identified ARTEX. Huntress points this out. The ConnectWise text says only agentic AI framework.
Actor
Microsoft: a China-state aligned actor (Storm-0940, active since 2021).
Same attacker?
This and the Korean bank case are two actors and are not merged. GTIG's UNC7228 overlaps with it.
Figures and definitions
2,250+
Number of tenants with attempted sign-ins, not the number compromised
Organizations
Microsoft: hundreds; digit.in headline: over 100
Password spraying
Oct 10 to 14: 327 accounts, 8 organizations, 151,000+ failures; peak of 2,900 per minute on Oct 11
Huntress
162 tenants confirmed (as of Oct 16 19:00 UTC); nearly 1,000 tenants with activity, 300+ successful
LLM involvement
Huntress: low to medium on its own data alone; medium to high with Microsoft's attribution added
Notes
The 2,900 per minute belongs to the spraying against 8 organizations. It is not the rate of the round against 2,250 tenants.
Related IoCs
Type
Value
Role
Check
App ID
0de14c77-b9b0-4137-9360-34878a929827
ConnectWise - MS Graph
Source report only
App ID
2399d300-6fca-4e6a-a686-399fefe75b83
ConnectWise Cloud Management: application identity disabled on October 17
Source report only
App ID
24205314-2b89-4e07-a2a4-579e898a5640
ConnectWise - MS Teams
Source report only
App ID
3f9cd7a0-127a-4ed4-bf06-2f830d5616b7
Application owner tenant ID seen on the app's service principal events (the vendor's tenant)
Source report only
App ID
412dcf96-176d-4b3a-a1b0-4981ad66971e
Cloud Management - Partner Center: application identity disabled on October 17
Source report only
App ID
506e08f9-6e9a-4da4-942b-a099a03644ae
ConnectWise Cloud Backup
Source report only
App ID
b2b55f5b-7758-4719-8d8f-88ae172e6bdb
Cloud Management - SharePoint Online: application identity disabled on October 17
Source report only
App ID
b78f6a77-d4e5-46fb-87e5-d1648bd02519
Cloud Management - Exchange Online: application identity disabled on October 17
Source report only
Network range
144[.]172[.]64[.]0/24
IP range referenced by Microsoft and Huntress as the range containing the associated activity
Source report only
IP
104[.]194[.]150[.]21
Not attributed to Storm-0940. No first or last seen dates
Platform: no verdict
IP
144[.]172[.]64[.]128
Storm-0940 infrastructure (Microsoft)
Platform: malicious
IP
144[.]172[.]64[.]60
Storm-0940 infrastructure (Microsoft)
Platform: no verdict
IP
144[.]172[.]64[.]99
Storm-0940 infrastructure (Microsoft)
Platform: no verdict
IP
144[.]172[.]94[.]243
Broad failed login spray, ongoing, many organizations
Platform: malicious
IP
167[.]88[.]172[.]97
Not attributed to Storm-0940. No first or last seen dates
Platform: no verdict
IP
187[.]15[.]88[.]186
VPN IP that accessed Graph API via compromised apps
Platform: no verdict
IP
187[.]15[.]89[.]186
VPN IP that accessed Graph API via compromised apps
Platform: no verdict
IP
187[.]15[.]90[.]217
VPN IP that accessed Graph API via compromised apps
Platform: no verdict
IP
194[.]165[.]16[.]21
Possible link based on re-use of python-requests/2.31 in a password spray during the same timeframe
