Threat intelligence writeups published today expand the scope of an ongoing supply chain compromise targeting delegated cloud identity relationships. State-sponsored threat actors leveraged stolen vendor application credentials to bypass tenant multi-factor authentication controls globally.
Post-incident telemetry linked the supply chain intrusion campaign to threat actor cluster Storm-0940. Adversaries utilized compromised service credentials associated with ConnectWise Cloud Backup to authenticate to Microsoft Entra ID endpoints. Because client tenants granted standing delegated administrative permissions to the integration, adversaries executed administrative API calls across more than 2,250 enterprise Microsoft 365 cloud environments, exfiltrating mailboxes and SharePoint repositories without deploying malware binaries.
Relying on persistent delegated administrative permissions creates severe cloud identity exposure across managed service provider ecosystems. When a third-party vendor application credential is stolen, adversaries ride existing trust relationships directly into customer tenant environments without triggering password reset barriers.
– Revoke all delegated administrative privileges and active OAuth integration tokens associated with ConnectWise Cloud Backup immediately.
– Enforce granular, time-bound Partner Admin relationships GDAP across all managed Microsoft Entra ID tenants.
– Audit cloud sign-in logs for high-volume service principal API calls originating from unverified external IP addresses.
– Restrict OAuth application consent policies to require explicit administrator approval for all multi-tenant application integrations.
Cloud identity governance requires continuous partner permission auditing and strict non-human identity monitoring to ensure enterprise cloud tenants remain protected against supply chain credential abuse. #CodeDefence #ConnectWise #Microsoft365 #Storm0940 #EntraID #SupplyChain #IdentitySecurity #CloudSecurity #AppSec
/
