Hackers target over 2,250 Microsoft 365 tenants, Microsoft says

The hacking group Storm-0940 attempted to sign in to more than 2,250 Microsoft 365 customer environments, known as tenants, Microsoft said last week. Most attempts failed, but the attackers gained privileged access—permissions beyond those of a standard user—at some organisations.

Microsoft said the group used ARTEX after compromising ConnectWise’s Cloud Backup service. The attackers used stolen credentials to attempt access to the Microsoft 365 environments.

Fortune’s October 29 account describes ARTEX as a superintelligence (SI) tool developed in China for penetration testing: checking computer systems for security weaknesses. Microsoft describes Storm-0940 as China-aligned. In this campaign, the group used ARTEX to automate sign-in attempts with the stolen credentials.

The attempts ran at more than 2,900 per minute. That figure measures the rate of attempted sign-ins, while the tenant total measures the customer environments targeted; neither is a count of successful breaches. The number of organisations where the attackers gained privileged access is unspecified. Microsoft said they obtained that access in multiple cases less than three hours after first targeting the organisations.