Microsoft Threat Intelligence has attributed this activity to the China-state-aligned threat actor and confirms no Microsoft systems were themselves compromised. ConnectWise identities were simply reanimated and walked right into tenants that had already granted them access. The Sixth Sense called: these apps didn't know they were dead. (2/3)
XFEDI
ActivityPubConversation
Affected administrators: rotate ConnectWise credentials now, audit M365 sign-in logs for anomalous ConnectWise application authentication, and restrict app permissions immediately.
Reward: You've been issued one Undead Conditional Access Policy. Please apply it before your next performance review. There may not be one.
CSO OnlineChina-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenantsMicrosoft said Storm-0940 leveraged an open-source AI framework and credentials stolen in a ConnectWise breach to automate cloud intrusions at machine speed.