Storm-0940 Tried to Access More Than 2,250 Microsoft 365 Tenants

Storm-0940, a China state-aligned hacking group, used compromised ConnectWise Cloud Backup application credentials to try to enter more than 2,250 Microsoft 365 tenants through applications customers had already authorized. The tenant count measures attempted sign-ins, not confirmed compromises. In multiple customer environments, the activity went beyond authentication to reconnaissance and changes to application credentials. Those observations do not establish how many customers, if any, suffered data theft. The compromised application identities gave the attackers a route through existing customer permissions.

Source: TokenPost