Evidence · DiggingBeagle record
Microsoft: Storm-0940, ARTEX and ConnectWise application trust
- Source role
- primary disclosure
Evidence record
Claim-level citations (3)
- supportsStorm-0940 used ARTEX and stolen ConnectWise application credentials: Microsoft observed attempted sign-ins to more than 2,250 tenants after unauthorized ConnectWise access; this is an attempted-access population, not a confirmed-victim count.
ConnectWise advisory paragraph immediately before the Password Spraying section
- supportsStorm-0940 used ARTEX and stolen ConnectWise application credentials: A distinct October 10-14 password spray produced over 151,000 failures against 327 accounts in eight organizations, with no successful authentication observed in that spray.
Password Spraying
- supportsStorm-0940 used ARTEX and stolen ConnectWise application credentials: In some downstream environments, Microsoft observed Graph reconnaissance and credential modifications intended to establish persistence.
Downstream customer access