Some of the Microsoft 365 tenants caught in the ConnectWise Cloud Backup attack had no active backup subscription at all. What they still had was the consent they had once given the app, and anyone holding the app’s compromised credential could use that consent to request a token.

Sophos X-Ops laid out the pattern in a write-up published Monday . The sweep it tracked on Oct. 15 came from a single virtual private server, lasted about 96 minutes and requested one app-only Microsoft Graph token per tenant, moving through tenants in strictly ascending GUID order. Former customers were on the list too, which Sophos said suggests the attacker was working from a full roster of every tenant that had consented to the application. Because the sign-ins used the application’s own identity, no user password or MFA prompt was involved.

Microsoft names Storm-0940

Microsoft assessed on Wednesday that Storm-0940, a China-state aligned group active since 2021, was responsible for the compromise.…