Campaign Scope Widens

A less likely but material downside is that Storm-0940 used the ConnectWise compromise as part of a broader credential-harvesting campaign against Microsoft 365 environments. This would turn the event into a larger software supply-chain and identity-security incident, with sharper sector read-through.

Each figure is the modeled move of the S&P 500 if the outcome occurs. For information only. Not investment advice.