Storm-0940 ConnectWise Cloud Backup Supply Chain Attack: Detection and Hardening Guide

---
title: ConnectWise Cloud Backup Agent Spawning Unexpected Child Process
id: 9f8e7d6c-5b4a-3c2d-1e0f-a9b8c7d6e5f4
status: experimental
description: Detects the ConnectWise Cloud Backup agent process spawning command shells, scripting engines, or compilers, which may indicate ARTEX framework activity or supply chain compromise.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.execution
  - attack.t1059
  - attack.supply_chain
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\CloudBackup.exe'
      - '\CWBackup.exe'
      - '\connectwise.backup.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\go.exe'
      - '\tinygo.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate backup agent updates or diagnostic scripts initiated by ConnectWise support
  - MSP automation tools interacting with the backup agent
level: high
---
title: Go-Based Binary Execution from Backup or Temp Directories
id: 8a7b6c5d-4e3f-2a1b-0c9d-8e7f6a5b4c3d
status: experimental
description: Detects execution of Go-compiled binaries from temporary, backup, or user-writable directories, a common ARTEX framework artifact.
references:
  - https://attack.mitre.org/techniques/T1204/
  - https://attack.mitre.org/techniques/T1036/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.defense_evasion
  - attack.t1036
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|startswith:
      - 'C:\Users\*\AppData\Local\Temp\'
      - 'C:\Windows\Temp\'
      - 'C:\ProgramData\ConnectWise\'
      - 'C:\Backup\'
  selection_go:
    - CommandLine|contains: 'go build'
    - Image|endswith:
        - '\go.exe'
        - '\tinygo.exe'
    - Description|contains: 'Go'
  condition: selection_path and selection_go
falsepositives:
  - Legitimate Go-based administrative tools deployed by IT
  - Developer activity on endpoints (rare in server/backup contexts)
level: medium
---
title: Anomalous Network Connection from ConnectWise Backup Process
id: 7c6d5e4f-3a2b-1c0d-9e8f-7a6b5c4d3e2f
status: experimental
description: Detects network connections from ConnectWise Cloud Backup agent processes to non-standard ports or unexpected geographic destinations, which may indicate C2 or exfiltration activity.
references:
  - https://attack.mitre.org/techniques/T1071/
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.exfiltration
logsource:
  category: network_connection
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\CloudBackup.exe'
      - '\CWBackup.exe'
      - '\connectwise.backup.exe'
  selection_ports:
    DestinationPort:
      - 443
      - 80
      - 53
      - 8080
      - 8443
  filter_known:
    DestinationHostname|contains:
      - 'connectwise.com'
      - 'cwbackup.com'
      - 'cloudbackup.connectwise.com'
  condition: selection_process and selection_ports and not filter_known
falsepositives:
  - Backup agent communicating with regional cloud storage endpoints
  - Content delivery network (CDN) IP ranges not covered by hostname filter
level: high

// Hunt for ConnectWise Cloud Backup agent spawning suspicious child processes
let suspiciousParents = dynamic(["CloudBackup.exe", "CWBackup.exe", "connectwise.backup.exe"]);
let suspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "go.exe", "tinygo.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName in~ (suspiciousParents)
| project ParentTime = TimeGenerated, DeviceName, DeviceId, ParentProcessId = ProcessId, ParentFileName = FileName, ParentCommandLine = ProcessCommandLine, AccountName, InitiatingProcessFileName
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where FileName in~ (suspiciousChildren)
    | project ChildTime = TimeGenerated, DeviceName, DeviceId, ProcessId, FileName, ProcessCommandLine, SHA256, FolderPath
) on DeviceId
| where ChildTime >= ParentTime and ChildTime <= ParentTime + 5m
| project ChildTime, DeviceName, FileName, ProcessCommandLine, FolderPath, SHA256, ParentFileName, ParentCommandLine, AccountName
| order by ChildTime desc;

// Hunt for Go binary compilation or execution in temp/backup paths
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where (FolderPath has_any ("AppData\\Local\\Temp", "Windows\\Temp", "ProgramData\\ConnectWise", "Backup"))
| where (FileName =~ "go.exe" or FileName =~ "tinygo.exe" or ProcessCommandLine contains "go build" or ProcessCommandLine contains "tinygo build")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath, SHA256, AccountName, InitiatingProcessFileName
| order by TimeGenerated desc;

// Network connections from backup agent to non-ConnectWise destinations
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName has_any ("CloudBackup", "CWBackup", "connectwise.backup")
| where not(RemoteUrl has_any ("connectwise.com", "cwbackup.com", "cloudbackup.connectwise.com"))
| where RemotePort in (443, 80, 53, 8080, 8443)
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort
| order by LastSeen desc;

-- Hunt for processes spawned by ConnectWise Cloud Backup agents and Go binary artifacts
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime,
       dict(
           ParentName=parent.Name,
           ParentCommandLine=parent.CommandLine
       ) as ParentInfo
FROM pslist()
WHERE Name =~ '(?i)(CloudBackup|CWBackup|connectwise\.backup)'
   OR CommandLine =~ '(?i)(go build|tinygo build)'
   OR Exe =~ '(?i)(AppData\\Local\\Temp|Windows\\Temp|ProgramData\\ConnectWise)'
ORDER BY CreateTime DESC

-- Hunt for network connections from backup agent processes to non-standard destinations
SELECT Pid, Name, CommandLine, RemoteAddr, RemotePort, Status,
       dict(
           ProcessPath=process.Exe
       ) as ProcessInfo
FROM netstat()
WHERE Name =~ '(?i)(CloudBackup|CWBackup|connectwise\.backup)'
   AND RemotePort IN (443, 80, 53, 8080, 8443)
   AND NOT RemoteAddr =~ '(?i)(connectwise|cwbackup)'
ORDER BY RemoteAddr

# ConnectWise Cloud Backup Integrity and Hardening Verification Script
# Run with elevated privileges on endpoints and servers with ConnectWise Cloud Backup installed

Write-Host "=== ConnectWise Cloud Backup Security Verification ===" -ForegroundColor Cyan

# 1. Verify ConnectWise Cloud Backup service status and binary path
$backupServices = Get-Service | Where-Object { $_.Name -match 'backup|connectwise' -and $_.Status -eq 'Running' }
foreach ($svc in $backupServices) {
    Write-Host "[INFO] Found service: $($svc.Name) - $($svc.DisplayName)" -ForegroundColor Green
    $proc = Get-Process -Id $svc.ProcessId -ErrorAction SilentlyContinue
    if ($proc) {
        Write-Host "       Path: $($proc.Path)" -ForegroundColor Gray
        Write-Host "       SHA256: $(Get-FileHash -Path $proc.Path -Algorithm SHA256 -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Hash)" -ForegroundColor Gray
    }
}

# 2. Check for unexpected child processes of backup agents
$suspiciousChildren = @('cmd.exe','powershell.exe','pwsh.exe','wscript.exe','cscript.exe','mshta.exe','rundll32.exe','regsvr32.exe','go.exe','tinygo.exe')
$backupProcs = Get-Process | Where-Object { $_.Name -match 'CloudBackup|CWBackup|connectwise.backup' }
foreach ($parent in $backupProcs) {
    $children = Get-CimInstance Win32_Process | Where-Object { $_.ParentProcessId -eq $parent.Id -and $suspiciousChildren -contains $_.Name }
    if ($children) {
        Write-Host "[ALERT] Backup process $($parent.Name) (PID: $($parent.Id)) has suspicious child processes:" -ForegroundColor Red
        foreach ($child in $children) {
            Write-Host "        - $($child.Name) (PID: $($child.ProcessId)) | CmdLine: $($child.CommandLine)" -ForegroundColor Yellow
        }
    }
}

# 3. Audit recent network connections from backup processes
Write-Host "`n[INFO] Auditing recent network connections from backup processes..." -ForegroundColor Cyan
$netConnections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
foreach ($conn in $netConnections) {
    $proc = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
    if ($proc -and $proc.Name -match 'CloudBackup|CWBackup|connectwise.backup') {
        $remoteHost = try { [System.Net.Dns]::GetHostEntry($conn.RemoteAddress).HostName } catch { "Unresolved" }
        if ($remoteHost -notmatch 'connectwise|cwbackup') {
            Write-Host "[ALERT] Non-ConnectWise connection: $($proc.Name) -> $($conn.RemoteAddress):$($conn.RemotePort) ($remoteHost)" -ForegroundColor Red
        }
    }
}

# 4. Check for Go binaries in temp/backup directories
Write-Host "`n[INFO] Scanning for Go binaries in high-risk directories..." -ForegroundColor Cyan
$scanPaths = @("$env:TEMP", "$env:ProgramData\ConnectWise", "C:\Backup", "$env:USERPROFILE\AppData\Local\Temp")
foreach ($path in $scanPaths) {
    if (Test-Path $path) {
        $goBinaries = Get-ChildItem -Path $path -Recurse -Filter "*.exe" -ErrorAction SilentlyContinue | Where-Object {
            $_.Name -match 'go|tinygo' -or
            (Get-Item $_.FullName).VersionInfo.FileDescription -match 'Go'
        }
        if ($goBinaries) {
            foreach ($bin in $goBinaries) {
                Write-Host "[ALERT] Potential Go binary found: $($bin.FullName)" -ForegroundColor Red
                Write-Host "        SHA256: $(Get-FileHash -Path $bin.FullName -Algorithm SHA256 | Select-Object -ExpandProperty Hash)" -ForegroundColor Yellow
            }
        }
    }
}

# 5. Verify backup agent version against vendor advisory
Write-Host "`n[INFO] Checking ConnectWise Cloud Backup agent version..." -ForegroundColor Cyan
$agentPath = Get-ChildItem -Path "${env:ProgramFiles}", "${env:ProgramFiles(x86)}", "$env:ProgramData" -Recurse -Filter "*backup*.exe" -ErrorAction SilentlyContinue | Where-Object { $_.Name -match 'CloudBackup|CWBackup' } | Select-Object -First 1
if ($agentPath) {
    $version = (Get-Item $agentPath.FullName).VersionInfo.ProductVersion
    Write-Host "[INFO] Detected agent version: $version" -ForegroundColor Green
    Write-Host "[ACTION] Compare against ConnectWise security advisory for known vulnerable versions." -ForegroundColor Magenta
} else {
    Write-Host "[WARNING] Could not locate ConnectWise Cloud Backup agent binary. Verify installation path manually." -ForegroundColor Yellow
}

Write-Host "`n=== Verification Complete ===" -ForegroundColor Cyan
Write-Host "Review all ALERT entries above. If suspicious activity is confirmed, isolate the host and initiate IR procedures." -ForegroundColor White