Storm-0940 and the ConnectWise Supply Chain Attack: Lessons for UK Organisations

Microsoft has attributed a significant supply chain attack on IT management platform ConnectWise to Storm-0940, a China-aligned threat actor, according to reporting by Dark Reading and TechCrunch. The attackers used an AI-enabled penetration-testing tool to automate their campaign, ultimately compromising more than 2,200 customer tenants downstream of the initial ConnectWise breach. ConnectWise is widely used by managed service providers and IT teams to remotely manage client environments, which meant that a single point of compromise created a pathway into thousands of organisations that had no direct vulnerability of their own.

Why this matters for UK organisations

This incident is one of the clearest recent illustrations of supply chain risk in practice. Organisations that were compromised in this campaign had done nothing wrong themselves — they were affected because a platform they trusted and relied upon was breached. For UK businesses that use managed service providers, remote monitoring and management tools, or shared IT platforms, this is a prompt to think carefully about what level of access those tools and providers have to their environments, and what assurance exists around the security of those relationships. The use of AI agents to accelerate lateral movement across thousands of tenants is also a meaningful development: it demonstrates that sophisticated, nation-state-aligned actors are actively using AI to compress attack timelines and scale their operations in ways that were not previously practical.

What to review

Organisations using ConnectWise should review access logs and audit privileged accounts for signs of unexpected activity. If you rely on a managed service provider that uses ConnectWise, it is reasonable to ask them directly what steps they have taken in response to this incident and what assurance they can provide about the integrity of your environment. More broadly, this is a good moment to review your third-party tool inventory — specifically, which tools have privileged or administrative access to your systems, what security assurance those vendors provide, and whether that assurance is reviewed regularly. Supply chain security is increasingly a board-level concern, and incidents like this demonstrate why.

Source: Dark Reading