ConnectWise Cloud Backup Credential Compromise Exposes Microsoft 365 Tenants

China-linked threat actor Storm-0940 abused stolen ConnectWise Cloud Backup application credentials to authenticate into Microsoft 365 tenants via non-interactive Microsoft Graph token issuance. The compromised service principal held broad permissions across Exchange Online, OneDrive, SharePoint, and Teams, enabling MFA and conditional access bypass. Attackers leveraged the ARTEX agentic AI framework to conduct approximately 2,900 sign-in attempts per minute, targeting over 2,250 tenants with confirmed access in 173. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management and disabled seven application identities.

• Incident Overview: ConnectWise Supply Chain Compromise

  • ConnectWise Cloud Backup (formerly SkyKick) exposed 173 Microsoft 365 tenants.
  • Huntress confirmed suspicious sign-ins across 162 tenants as of October 16, 2026.
  • Broader campaign targeted over 2,250 tenants; no confirmed data theft, but exfiltration cannot be ruled out.

• Attack Vector: Non-Interactive Graph Authentication

  • Stolen ConnectWise application credentials enabled non-interactive sign-ins via Microsoft Graph without MFA prompts.
  • ARTEX agentic AI framework automated reconnaissance and authentication at roughly 2,900 attempts per minute.
  • Attackers assigned Global Administrator roles and added credentials to other applications within approximately five minutes in one partner tenant.

• Threat Actor: Storm-0940 and ARTEX

  • Storm-0940 is a China state-aligned threat actor active since 2021 and linked to ARTEX usage since September 2026.
  • Abused broad backup permissions spanning Exchange Online, OneDrive, SharePoint, and Teams.
  • Sign-in activity observed October 15, 2026; log review recommended back to October 1 where records allow.

• Indicators of Compromise

  • Malicious authentication IPs: 144.172.64.128, 144.172.64.99, and 144.172.64.60.
  • Seven ConnectWise application identities disabled; associated certificates revoked.
  • Audit Entra ID sign-in logs, application consents, directory roles, and persistence mechanisms for unauthorized changes.

• Vendor Remediation and Service Impact

  • ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services.
  • Scheduled backups, archive access, restoration, monitoring, alerting, and user/license management were unavailable.
  • Time to privileged access under three hours in some environments.

• Strategic Implications

  • Machine-speed attack timelines exceed human SOC response capabilities, requiring automated containment.
  • Implicit trust in third-party machine identities creates critical gaps in human-centric zero trust models.
  • Successful authentication or application presence does not confirm data exfiltration.