{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:10:46.198Z",
  "tag": {
    "id": "microsoft-365",
    "label": "Microsoft 365",
    "isStack": false,
    "url": "https://pwn.watch/t/microsoft-365",
    "feed": "https://pwn.watch/t/microsoft-365/feed.xml"
  },
  "counts": {
    "incidents": 3,
    "live": 1,
    "notFullyPatched": 1,
    "patched": 2
  },
  "incidents": [
    {
      "slug": "connectwise-cloud-backup-m365-hijack",
      "title": "ConnectWise Cloud Backup shut down after M365 app-identity hijack",
      "url": "https://pwn.watch/i/connectwise-cloud-backup-m365-hijack",
      "json": "https://pwn.watch/i/connectwise-cloud-backup-m365-hijack.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "partial",
      "product": "ConnectWise Cloud Backup / Microsoft 365 app identity",
      "tags": [
        "connectwise",
        "microsoft",
        "microsoft-365"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Cloud Backup service (shut down)"
      ],
      "fixedVersions": [],
      "startedAt": "2026-10-17",
      "closedAt": null,
      "updatedAt": "2026-10-22T21:09:59+02:00",
      "summary": "ConnectWise disabled Cloud Backup after a compromised credential let attackers authenticate as the application and sign in to at least 173 customer Microsoft 365 tenants.",
      "xPost": null
    },
    {
      "slug": "microsoft-midnight-blizzard-corporate-email-breach",
      "title": "Midnight Blizzard breaches Microsoft corporate email",
      "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach",
      "json": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Microsoft corporate email (Microsoft 365)",
      "tags": [
        "microsoft",
        "microsoft-365",
        "midnight-blizzard",
        "espionage",
        "password-spraying",
        "data-breach",
        "nation-state"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2024-01-12",
      "closedAt": "2024-04-02",
      "updatedAt": "2024-04-02",
      "summary": "Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.",
      "xPost": null
    },
    {
      "slug": "microsoft-storm-0558-forged-tokens-exchange-online-2023",
      "title": "Storm-0558: stolen Microsoft signing key used to read government email",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023",
      "json": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Microsoft Exchange Online / Outlook.com (Azure AD and MSA token signing)",
      "tags": [
        "microsoft",
        "microsoft-365",
        "exchange-online",
        "azure",
        "china",
        "token-forgery",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-05-15",
      "closedAt": "2023-09-06",
      "updatedAt": "2023-09-06",
      "summary": "China-based Storm-0558 used a stolen Microsoft consumer (MSA) signing key, plus a token validation bug, to forge tokens and read Exchange Online and Outlook.com mail at about 25 organisations, including US government agencies. Microsoft later said the key leaked through a 2021 crash dump.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "SC Media",
      "handle": "SCMagazine",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1382075890935468032/wEHUGLMA_bigger.jpg",
      "text": "A stolen @ConnectWise app credential exposed Microsoft 365 tenants to unauthorized access and privilege escalation. The breach highlights the risks of overprivileged app identities. #cybersecurity #CISO #infosec https://t.co/Xyi8IHRc6u",
      "date": "2026-10-22T13:28:01.000Z",
      "url": "https://x.com/SCMagazine/status/2113261090419233058",
      "media": [],
      "incident": "connectwise-cloud-backup-m365-hijack"
    },
    {
      "authorName": "The Register",
      "handle": "TheRegister",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1790422162228277252/Kn-bAizu_bigger.jpg",
      "text": "China-aligned attackers used AI agents and compromised ConnectWise application creds to target more than 2,250 Microsoft 365 tenants, the vendor says. \nMore here: https://t.co/CrHYzab3cD",
      "date": "2026-10-22T12:34:34.000Z",
      "url": "https://x.com/TheRegister/status/2113247638976102527",
      "media": [],
      "incident": "connectwise-cloud-backup-m365-hijack"
    }
  ],
  "changes": [
    {
      "incident": "connectwise-cloud-backup-m365-hijack",
      "incidentTitle": "ConnectWise Cloud Backup shut down after M365 app-identity hijack",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Microsoft details Storm-0940's Oct 10-14 password spray (151,000+ failed logons, peak 2,900/min) before the Oct 15 takeover of ConnectWise cloud app identities; ConnectWise says phased service restoration will take several days.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html",
      "url": "https://pwn.watch/i/connectwise-cloud-backup-m365-hijack"
    },
    {
      "incident": "connectwise-cloud-backup-m365-hijack",
      "incidentTitle": "ConnectWise Cloud Backup shut down after M365 app-identity hijack",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "ConnectWise CEO Manny Rivelo says the affected application connections are contained and services are being restored gradually, but cutting those connections won't necessarily evict attackers who already set up persistent access in customer tenants. Microsoft hasn't said how many customers were compromised.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687",
      "url": "https://pwn.watch/i/connectwise-cloud-backup-m365-hijack"
    },
    {
      "incident": "connectwise-cloud-backup-m365-hijack",
      "incidentTitle": "ConnectWise Cloud Backup shut down after M365 app-identity hijack",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Wiz Research says the same ARTEX-using actor, overlapping with Storm-0940, is also targeting other IT and software vendors: password-spraying Okta and Entra, abusing Cognito and account-recovery endpoints, and probing Microsoft 365 integrations and tenant isolation. Wiz published IPs and user agents to hunt for.",
      "body": null,
      "sourceUrl": "https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors",
      "url": "https://pwn.watch/i/connectwise-cloud-backup-m365-hijack"
    },
    {
      "incident": "connectwise-cloud-backup-m365-hijack",
      "incidentTitle": "ConnectWise Cloud Backup shut down after M365 app-identity hijack",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "Microsoft attributes the ConnectWise supply-chain compromise to China-aligned Storm-0940, using the agentic AI framework ARTEX; 2,250+ Microsoft 365 tenants targeted.",
      "body": null,
      "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/",
      "url": "https://pwn.watch/i/connectwise-cloud-backup-m365-hijack"
    },
    {
      "incident": "microsoft-midnight-blizzard-corporate-email-breach",
      "incidentTitle": "Midnight Blizzard breaches Microsoft corporate email",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-04-02",
      "title": "CISA issues Emergency Directive 24-02 for agencies whose email with Microsoft was exposed",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/directives/ed-24-02-mitigating-significant-risk-nation-state-compromise-microsoft-corporate-email-system",
      "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach"
    },
    {
      "incident": "microsoft-midnight-blizzard-corporate-email-breach",
      "incidentTitle": "Midnight Blizzard breaches Microsoft corporate email",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-01-25",
      "title": "Microsoft publishes guidance for responders on the Midnight Blizzard attack",
      "body": null,
      "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/",
      "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach"
    },
    {
      "incident": "microsoft-midnight-blizzard-corporate-email-breach",
      "incidentTitle": "Midnight Blizzard breaches Microsoft corporate email",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-01-12",
      "title": "Microsoft detects a nation-state attack on its corporate systems",
      "body": null,
      "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/",
      "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach"
    },
    {
      "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023",
      "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-06",
      "title": "Microsoft: the key most likely leaked via a 2021 crash dump that reached its corporate network",
      "body": null,
      "sourceUrl": "https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023"
    },
    {
      "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023",
      "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-14",
      "title": "Microsoft details how the stolen MSA key was used to forge tokens",
      "body": null,
      "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023"
    },
    {
      "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023",
      "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-11",
      "title": "Microsoft discloses the intrusion; CISA and FBI publish AA23-193A",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023"
    },
    {
      "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023",
      "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-16",
      "title": "Microsoft opens an investigation after a customer reports anomalous mail access",
      "body": null,
      "sourceUrl": "https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023"
    },
    {
      "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023",
      "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-15",
      "title": "Storm-0558 begins accessing customer email with forged tokens",
      "body": null,
      "sourceUrl": "https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023"
    }
  ]
}