Active Exploitation Alert: SaaS Supply Chain Attack Targets Microsoft 365 via ConnectWise and Atera Credential Compromise

Executive Summary

In October 2026, a sophisticated supply chain attack targeted the wider SaaS ecosystem, leveraging stolen credentials from ConnectWise and Atera to access Microsoft 365 tenants. The attacker, attributed by Microsoft to the China-state-aligned actor Storm-0940, used a novel “tenant spray” technique to request OAuth tokens from numerous organizations, including those that never installed the compromised apps. The campaign also involved password spraying against Okta and Entra ID tenants, using the same infrastructure. The attack bypassed traditional security controls such as multi-factor authentication (MFA) and Conditional Access by exploiting app-only authentication flows. Nearly 1,000 Entra tenants were probed, with a focus on IT and legal sectors, but the risk extends to any organization using multi-tenant SaaS integrations. All findings and technical evidence are sourced from the official Obsidian Security report published on October 23, 2026 (https://www.obsidiansecurity.com/incident-watch/wider-saas-supply-chain-targeting-beyond-connectwise).

Technical Information

The incident began with the use of stolen ConnectWise credentials to request access tokens for Microsoft 365 tenants. The attacker did not limit their activity to tenants where the app was installed; instead, they attempted to authenticate across a broad range of organizations, a method termed “tenant spray.” This technique involves using a single valid app credential (such as a client secret or certificate) to request tokens from many tenants, regardless of whether the app is present. This approach is analogous to password spraying but targets organizations rather than individual user accounts.

The attacker also compromised an integration credential belonging to Atera and attempted to use credentials from a legal-sector IT provider. The infrastructure used for these attacks consisted of four IP addresses registered to Frantech Solutions (AS14956), which had no prior telemetry before the campaign. The attacker’s tooling was entirely scripted, utilizing user agents such as Python-urllib/3.12, python-requests/2.31, curl/7.88.1, curl/8.0, and spoofed Chrome user agents.

A critical aspect of the attack was the enumeration of tenant status and credential validity via error codes returned by Microsoft Entra’s token endpoint. Specifically, error codes AADSTS 7000229 (app not installed, but credential valid) and AADSTS 7000215 (invalid credential) allowed the attacker to determine whether a credential was valid and whether the app was present in a tenant. This reconnaissance enabled the attacker to map out which organizations were vulnerable to further exploitation.

The attack bypassed MFA and Conditional Access policies because app-only sign-ins (OAuth client credentials flow) do not trigger user-based security controls. This allowed the attacker to operate without user interaction or additional authentication challenges. The campaign also included password spraying against Okta and Entra ID tenants, attempting to brute-force user credentials from the same infrastructure.

No malware or custom implants were deployed during the campaign. All activity was conducted via abuse of legitimate cloud APIs and protocols, specifically Microsoft Graph and OAuth endpoints. The attacker’s methods align with several MITRE ATT&CK techniques, including Valid Accounts (T1078), Password Spraying (T1110.003), Cloud Account Persistence (T1136.003), Defense Evasion (T1078, T1562), Cloud Service Discovery (T1526), and Application Layer Protocol (T1071).

Attribution to Storm-0940 is based on Microsoft’s public statement, with a medium confidence level due to the absence of unique malware or infrastructure links in the public report. The attacker’s focus on SaaS supply chain attacks, use of stolen vendor credentials, and enumeration via error codes are consistent with known tactics of China-state-aligned groups, but the “tenant spray” technique is newly documented in this incident.

The campaign’s impact was broad, with nearly 1,000 Entra tenants probed. While IT and legal sectors were specifically targeted, the risk extends to any organization using multi-tenant SaaS integrations. The attacker’s ability to leverage compromised vendor credentials across multiple organizations highlights the systemic risk posed by supply chain vulnerabilities in the SaaS ecosystem.

Affected Versions & Timeline

The attack targeted Microsoft 365 tenants via compromised credentials from ConnectWise, Atera, and a legal-sector IT provider. The timeline of activity is as follows: from October 10 to 13, the attacker conducted password spraying against Okta tenants; from October 13 to 15, password spraying and app credential attempts were made, including the use of ConnectWise credentials; on October 15, the “tenant spray” technique was executed using the ConnectWise credential; from October 16 to 18, further attempts were made using credentials from a legal-sector IT provider; from October 18 to 19, the Atera credential was used for tenant spray; and on October 21, password spraying continued against new targets. The attacker’s infrastructure remained active at least until October 21, 2026.

Threat Activity

The threat actor’s campaign was characterized by the use of stolen vendor app credentials to request OAuth tokens from a wide range of Microsoft 365 tenants. The “tenant spray” technique allowed the attacker to test a single credential against many organizations, gaining access wherever the app was installed and enabled. The attacker also performed password spraying against Okta and Entra ID tenants, attempting to brute-force user credentials. All activity originated from four IP addresses at Frantech Solutions, with user agents indicative of scripted tooling.

The attacker’s methods included enumeration of tenant status and credential validity via error codes, bypassing MFA and Conditional Access policies through app-only sign-ins, and targeting multiple vendors to amplify the impact of the integration compromise. The campaign was not limited to a single sector, with nearly 1,000 Entra tenants probed, but IT and legal sectors were specifically targeted through the use of credentials from a legal-sector IT provider and direct attacks on law firms.

No malware was deployed during the campaign; all activity was conducted via abuse of legitimate cloud APIs and protocols. The attacker’s infrastructure and techniques are consistent with previous campaigns attributed to China-state-aligned actors, but the specific “tenant spray” technique is newly documented in this incident.

Mitigation & Workarounds

For vendors, it is critical to rotate client secrets regularly, remove unused secrets, prefer certificates or managed identities where possible, and maintain a clear record of legitimate authentication sources to enable detection of anomalous activity. For customers, organizations should inventory all third-party service principals in their Entra tenant, review the permissions each one holds—especially those with application permissions to mail, files, or directory data—and disable service principals for vendor apps that are not in use. Monitoring for service principal sign-ins with error codes 7000229 and 7000215 from unfamiliar infrastructure is essential, as is reviewing both Entra and Okta logs for suspicious activity, particularly in federated environments.

Indicators of Compromise

The following table contains indicators of compromise (IOCs) identified in the official Obsidian Security report. These indicators are point-in-time and should be validated in your environment before enforcement.

References

All technical evidence and recommendations are sourced from the official Obsidian Security incident report, published October 23, 2026: https://www.obsidiansecurity.com/incident-watch/wider-saas-supply-chain-targeting-beyond-connectwise

About Rescana

Rescana provides a Third-Party Risk Management (TPRM) platform designed to help organizations identify, assess, and monitor risks associated with their SaaS supply chain and vendor integrations. Our platform enables continuous visibility into third-party service principals, credential exposures, and integration risks, supporting proactive mitigation of supply chain threats.

We are happy to answer questions at info@rescana.com.