Storm-0940 gets into cloud tenants with passwords guessed by thousands of hijacked home and small office routers, each trying one account once a day, which is why lockout thresholds and IP blocklists rarely see it. Microsoft Threat Intelligence described the actor and its supplier network, CovertNetwork-1658, in October 2024 and assessed both as China-based. This profile is for Entra ID and Microsoft 365 administrators, SOC analysts and MSPs that hold delegated access to client tenants. It covers names and attribution as Microsoft states them, targeting, ATT&CK techniques mapped by NHI Mgmt Group (Storm-0940 is not an ATT&CK group), the identity abuse pattern, incidents and a detection and hardening plan. General spraying defence is in the Password Spraying and Credential Stuffing Defence Guide; this page covers what is specific to this actor.
Key takeaways
- The spray is built to stay under thresholds. Microsoft reports about 80 per cent of CovertNetwork-1658 campaigns made only one sign-in attempt per account per day, from rotating router IPs, so per-IP and per-account failure alerts do not fire.
- Two actors, one pipeline. CovertNetwork-1658 obtains the credentials; Storm-0940 used them for initial access, sometimes on the same day, which Microsoft cites as evidence of a close working relationship.
- Multiple Chinese actors share the output. Microsoft assesses that several Chinese threat actors use credentials from the network, so a spray hit may be exploited by a different group.
- MFA with no exclusions is the decisive control. Microsoft's first recommendations are MFA on all accounts without exclusions, disabling legacy authentication and blocking it with Conditional Access.
- Application identities are now in the frame. A 2026 incident in which a stolen backup application credential reached customer tenants has been reported as linked to Storm-0940; MFA never applies to an app signing in with its own secret.
Who they are (names and aliases)
Microsoft uses "Storm-" names for emerging or developing clusters it has not yet given a full weather-themed name. In its 31 October 2024 report Microsoft describes Storm-0940 as a Chinese threat actor active since at least 2021, which gains initial access through password spraying and brute force, or by exploiting or misusing network edge applications and services. Microsoft separately assesses that a threat actor located in China established and maintains CovertNetwork-1658. The two are tracked as distinct entities.
| Name | What it is | Source |
|---|---|---|
| Storm-0940 | Operator that uses sprayed credentials for intrusion and data theft | Microsoft Threat Intelligence |
| CovertNetwork-1658 | Network of compromised SOHO routers, mostly TP-Link, used to spray | Microsoft Threat Intelligence |
| xlogin, Quad7 (7777) | Other names for CovertNetwork-1658, from the backdoor and its TCP port 7777 | Named by Microsoft as aliases; public reports by Sekoia (July 2024) and Team Cymru (August 2024) |
Storm-0940 has no MITRE ATT&CK group entry in v20. Networks of this kind are often called operational relay box (ORB) networks; see the Operational Relay Box Networks Guide.
Targeting and motivation
- Sectors: Microsoft lists think tanks, government organisations, non-governmental organisations, law firms and the defence industrial base, among others.
- Regions: North America and Europe.
- Motivation: Microsoft describes the use of the credentials for computer network exploitation and notes post-compromise attempts to exfiltrate data, consistent with intelligence collection. It does not describe financial motives.
- Cloud tenants specifically: Microsoft observed increased Azure tenant targeting between 8 and 30 October 2024, which it said may indicate the operation was acquiring new infrastructure after public exposure.
- Service providers as multipliers: the 2026 ConnectWise Cloud Backup incident, reported as linked to Storm-0940, affected managed service providers and their Microsoft 365 customer tenants, including law firms and policy organisations.
Tactics and techniques (MITRE ATT&CK)
Storm-0940 is not mapped in ATT&CK. The techniques below are mapped by NHI Mgmt Group from Microsoft's description to the closest ATT&CK v20 technique.
| Tactic | Technique | Behaviour in Microsoft's report |
|---|---|---|
| Resource development | T1584.008 Network Devices; T1584.005 Botnet | SOHO routers exploited for remote code execution (exploit still under investigation at publication); about 8,000 active devices at any time, about 20 per cent spraying |
| Command and control | T1090.003 Multi-hop Proxy | xlogin backdoor shell on TCP 7777; SOCKS5 proxy on TCP 11288; thousands of rotating IPs, average node uptime about 90 days |
| Credential access | T1110.003 Password Spraying; T1110 Brute Force | Very few sign-in attempts per account; around 80 per cent of cases one attempt per account per day |
| Initial access | T1078.004 Cloud Accounts | Sprayed credentials used by Storm-0940, sometimes the same day |
| Initial access | T1190 Exploit Public-Facing Application | Exploiting or misusing network edge applications and services |
| Credential access, discovery | T1003 OS Credential Dumping; T1046 Network Service Discovery | Scanning and credential dumping tools for lateral movement |
| Persistence | T1133 External Remote Services (closest fit) | Attempts to access network devices and install proxy tools and remote access trojans |
How they abuse identities and credentials
This actor's whole operation is identity abuse. Every stage depends on an account that accepts a password alone or a credential that is not bound to a device or location.
| Weakness exploited | Why the spray works | Control that removes it |
|---|---|---|
| Accounts excluded from MFA (service, shared, break-glass, "temporary") | A correct password is enough | MFA for every interactive account; replace shared and service accounts that sign in interactively with workload identities |
| Legacy authentication (basic auth protocols) | Bypasses Conditional Access MFA | Block legacy authentication with Conditional Access |
| Weak or reused passwords | Spray lists hit common choices | Entra Password Protection with a custom banned list; user education on reuse |
| Stale accounts | Nobody notices the sign-in | Disable stale accounts, as Microsoft recommends |
| Federated sign-in without lockout | AD FS accepts unlimited guesses | AD FS extranet lockout and Entra Connect Health for AD FS |
| Application client secrets | An app signing in with a secret never meets MFA | Certificates or federated credentials instead of secrets; Conditional Access for workload identities on single-tenant service principals; monitor service principal sign-ins |
- Same-day use means minutes matter: because credentials were sometimes used the day they were obtained, the time from a successful spray to session revocation is the key response measure.
- Workload identity limits: Microsoft Learn states that Conditional Access for workload identities covers single-tenant service principals only, needs Workload Identities Premium, and offers block as its only grant control. Multi-tenant SaaS apps, such as a backup vendor's app, are not covered, so their credentials depend on the vendor's own security. See the Azure Entra Client Secrets Security Guide.
- Delegated MSP access: one provider identity with rights in many tenants turns one successful guess into many intrusions. See the GDAP and MSP Delegated Admin Access Guide.
Notable incidents
| Date | Event | Source |
|---|---|---|
| Since at least 2021 | Storm-0940 active, per Microsoft | Microsoft Threat Intelligence, October 2024 |
| July and August 2024 | Public reports on the Quad7 router network by Sekoia and Team Cymru; Microsoft links a steep drop in available nodes from 1 August to 29 October 2024 to this exposure | Microsoft Threat Intelligence, October 2024 |
| 8 to 30 October 2024 | Increased Azure tenant targeting, which Microsoft assessed may reflect new infrastructure | Microsoft Threat Intelligence, October 2024 |
| 31 October 2024 | Microsoft publishes its report and notifies targeted or compromised customers | Microsoft Threat Intelligence |
| October 2026 | Spraying against law firm tenants and a stolen ConnectWise Cloud Backup application credential used to sign in to Microsoft 365 customer tenants; Todyl reports that Microsoft linked the activity to Storm-0940 | See the ConnectWise Cloud Backup Breach 2026 |
The 2026 attribution is second-hand at the time of writing: NHI Mgmt Group has not read a Microsoft statement linking Storm-0940 to the ConnectWise incident, so treat that link as reported, not confirmed.
Detection and defence
Detection signals
| Signal | Where | Notes |
|---|---|---|
| Failed sign-ins aggregated by ISP or ASN: many accounts, many countries, many IPs in a short window | Entra sign-in logs, Defender XDR | Microsoft's hunting query uses four hours, at least 100 targeted accounts, 5 countries and 25 IPs per ISP |
| Microsoft-published user agent strings on failed sign-ins | Sign-in logs | Microsoft rates the Chrome/80 string as low fidelity on its own |
| Password correct, MFA not completed (error 50074 or 50072) from unfamiliar locations | Entra sign-in logs | Password is compromised even if the account is not; reset it |
| Identity Protection detections: password spray, unfamiliar sign-in properties, atypical travel | Entra ID Protection, Defender for Identity | Named by Microsoft as relevant detections |
| AD FS Event IDs 411, 342 and 516 (1203 on AD FS 2016 and 2019) | AD FS with verbose auditing | Microsoft's password spray playbook lists these |
| Service principal sign-ins from new IPs or a spike in tenants for one multi-tenant app | Service principal sign-in logs | The pattern in the 2026 backup application incident |
| Service principals added to directory roles or gaining new credentials | Entra audit logs | Persistence through application identities |
Hardening plan
- Week 1: export every account that can sign in without MFA, and every Conditional Access exclusion. Close each, or document and monitor it. Keep two emergency access accounts with phishing-resistant MFA and alerting.
- Week 2: create a Conditional Access policy blocking legacy authentication in report-only mode, review a week of results for broken clients, then enforce.
- Weeks 2 to 4: enable Entra Password Protection with a custom banned list, Identity Protection risk policies where licensed, and AD FS extranet lockout if federated. Disable stale accounts.
- Weeks 4 to 8: deploy the ISP-level failed sign-in hunting logic as a scheduled detection; tune thresholds to your tenant size.
- Quarter 1: inventory multi-tenant apps and partner relationships with privileged rights; replace application secrets with certificates where you own the app; apply workload identity Conditional Access to single-tenant service principals.
Rollback: a legacy authentication block that breaks a business system can go back to report-only immediately while the client is upgraded; do not add a permanent exclusion.
Response after a confirmed spray success
- Contain: reset the password, revoke sessions and refresh tokens, mark the user compromised in Identity Protection, and block the source where it is not a shared residential range.
- Scope: check mailbox rules, delegations, new MFA methods, app consents and data access, as Microsoft's playbook sets out.
- Tell the provider: if a vendor or MSP identity was involved, notify them and disable its access until it rotates credentials.
Metrics
- Interactive accounts without MFA: target zero outside documented emergency access accounts.
- Legacy authentication sign-ins: target zero per week.
- Time from spray success to session revocation: target under one hour, given same-day use.
- Privileged multi-tenant apps reviewed in the last 90 days: target 100 per cent.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | IA-2 Identification and Authentication, IA-2(1) Multi-factor Authentication to Privileged Accounts, AC-7 Unsuccessful Logon Attempts | MFA and lockout against spraying |
| NIST SP 800-53 Rev. 5 | SI-4 System Monitoring | Aggregated sign-in analytics |
| NIST CSF 2.0 | PR.AA-03, DE.CM-03 | Authentication of users and services; monitoring account activity |
Practitioner checklist
- Remove every MFA exclusion that is not an emergency access account.
- Block legacy authentication with Conditional Access after a report-only review.
- Add a detection that groups failed sign-ins by ISP or ASN across many accounts.
- Treat "password correct, MFA failed" as a password compromise and force a reset.
- Enable AD FS verbose auditing and extranet lockout, or move to cloud authentication.
- Inventory multi-tenant and partner apps with directory or mailbox rights and remove what is unused.
- Alert on service principals gaining roles or new credentials.
- Replace end-of-life SOHO routers at remote and home offices you manage. See the SOHO and SMB Router Hardening Guide.
Standards and references
- Microsoft Threat Intelligence: Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network
- Microsoft Learn: Password spray investigation playbook
- Microsoft Learn: Conditional Access for workload identities
- MITRE ATT&CK: Brute Force: Password Spraying
- MITRE ATT&CK: Compromise Infrastructure: Network Devices
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Password Spraying and Credential Stuffing Defence Guide · Operational Relay Box Networks Guide · Conditional Access Guide · Entra ID Sign-In and Audit Log Detection Guide · Threat Actor Groups Guide