Microsoft Says Storm-0940 Stole ConnectWise Credentials to Reach Customer Microsoft 365 Environments

Microsoft says China state-aligned hackers, tracked as Storm-0940, breached ConnectWise's cloud backup service and stole the application credentials it uses to connect with corporate customers. Those stolen credentials let attackers sign in as authorized users to customer Microsoft 365 environments, including email and files. ConnectWise has paused access to the backup system and is investigating.