Storm-0940 and the ConnectWise Cloud Backup Compromise: How Trusted App Identities Opened 2,250+ Microsoft 365 Tenants

CISO Platform Intelligence · Threat Actors · Cloud & Identity · Updated Oct 29, 2026

TL;DR

Microsoft attributes the campaign to Storm-0940, a China state-aligned actor active since 2021. Microsoft says the actor used ARTEX, an open-source multi-agent AI pentest framework, to automate reconnaissance, password spraying and OAuth app abuse, and assesses that Storm-0940 carried out the ConnectWise Cloud Backup (formerly SkyKick) supply-chain compromise.
The attacker controlled credentials for several trusted ConnectWise multi-tenant app identities and used them to authenticate as service principals into downstream Microsoft 365 tenants, with no interactive user sign-in, so user MFA was not the control that mattered. Microsoft counts sign-in attempts against more than 2,250 tenants, says most failed, and says some intrusions reached privileged cloud access in under three hours.
Persistence planted inside tenants (self-assigned admin roles, secrets added to other apps, some valid through 2028) survives the vendor's own fix. Disabling the vendor app does not clean your tenant.

What happened

Date (2026)	Event
Sept	Earliest ARTEX-driven activity Microsoft has identified.
Oct 10–14	Password spray from 144.172.64[.]99: 327 accounts in eight organizations, 151,000+ failed sign-ins, peaking around 2,900 per minute on Oct 11. Microsoft saw no successful authentication from the spray itself. Huntress describes unsuccessful guessing against four law firms on Oct 13–14.
Oct 15	A stolen credential is used to sign in as the backup app from 06:13 to roughly 08:34–08:46 UTC (sources differ slightly), walking tenant IDs in ascending order. ConnectWise says it discovered the issue that day; The Hacker News puts first identification around Oct 14.
Oct 16	ConnectWise publishes its initial advisory. Huntress confirms unauthorized access in at least 162 tenants.
Oct 17	ConnectWise disables seven application identities, revokes their certificates, invalidates the shared Cloud Backup credentials and suspends Cloud Backup. SaaS Security and Cloud Management are suspended as a precaution.
Oct 20	Per The Hacker News, ConnectWise's update says the account and credential reset is complete.
Oct 21	Microsoft Threat Intelligence publishes its analysis. Phased restoration begins.

Technical analysis

Initial access to the vendor: not publicly known. ConnectWise says it has not established whether a product vulnerability contributed. Microsoft does not explain how the backup application was breached, but links the spray infrastructure (the 144.172.64.x range) to the later app sign-ins.

App identity abuse: the ConnectWise apps (Cloud Backup, a Teams management app and a Graph app) already held admin consent in customer tenants. The attacker used their credentials to obtain app-only tokens. According to Huntress, the credential worked in every organization that had granted the app access. In one burst, 200+ sign-ins took under four minutes using four app credentials. User agents included Python-urllib/3.12, python-requests and curl.

Post-access actions via Microsoft Graph (Microsoft and Huntress):

A management app assigned itself Global Administrator. In one tenant, the attacker moved GA to a sibling principal after the original principal resisted removal.
Service principals self-assigned roles, mostly Exchange Administrator, in roughly 50 monitored organizations.
Secrets were added to other apps, including an MSP management tool and Huntress's own app, with validity into 2028.
Changes to users, groups, authentication methods and Conditional Access; in some cases bulk reads of secrets across multiple Azure Key Vaults.

Huntress observed post-compromise activity in a small number of tenants; in the cases it examined, activity was limited to directory reads, with no sign of mailbox or file changes.

Agentic tooling: Microsoft describes ARTEX as a Go-based, model-agnostic, multi-agent LLM system that builds an asset and vulnerability graph and can run from recon to exfiltration with little human input. Agents try several paths at once, which compresses dwell time. Microsoft also reports other actors in multiple regions using ARTEX. Huntress, from its own telemetry alone, rates LLM involvement low to medium (medium to high including Microsoft's attribution). The certificate-to-secret fallback and fixed retry timings fit automation, but that alone does not prove AI was involved.

Why it happened

Standing, broad application permissions granted to a multi-tenant vendor app concentrate risk: one stolen credential opened every consenting tenant.
App-only authentication bypasses user MFA and user-session revocation.
Visibility is weak. Huntress knew of no victim with Graph activity logging enabled; Entra audit logs do not record Graph reads, and app-only events lack a source IP.
Automation reduced the defender's response window to hours.

Who is affected

Organizations, and the MSPs serving them, that consented to ConnectWise Cloud Backup, SaaS Security or Cloud Management, including older tenants where the app appears as "SkyKick Cloud Manager." ConnectWise serves more than 100,000 MSPs; Huntress reviewed more than 10,000 tenants with ConnectWise apps installed. The total number of compromised tenants is not publicly known; Huntress's counts (162+ tenants, 300+ successful sign-ins) cover only its own visibility. ConnectWise says it cannot see into customer tenants and that backups remained encrypted and isolated, with no evidence they were accessed. Help Net Security separately reports a targeted wave against 16 organizations in the policy, national-security, trade and critical-minerals sectors.

How it affects CISOs

A consented SaaS app is a privileged identity that sits outside most PAM, MFA and access-review programs. When the vendor is compromised, your tenant inherits that compromise. Vendor containment does not undo changes already made in your tenant, and tokens issued before shutdown may stay valid until they expire. Your incident-response plan needs to cover revoking application access, not only user sessions.

What to do

Immediate (24h)

Disable the ConnectWise apps without deleting them, to preserve evidence. Search by application ID, not display name. Do not reconnect until ConnectWise issues formal restoration instructions.
Preserve Entra sign-in and audit logs, Purview audit data and SIEM data.
Pull service-principal sign-ins from at least Oct 15 (ideally Oct 1). Review successful and failed sign-ins separately, and do not limit the search to the published IPs (144.172.64[.]128, .99, .60).

This week

List every secret or certificate added to any app since Oct 13. Remove any whose owner cannot account for it, then rotate.
Review directory roles held by service principals, especially Global Administrator, Privileged Role Administrator and Exchange Administrator; also app-role and consent grants, new owners and Conditional Access changes.
Check for bulk Key Vault secret reads. Run Microsoft's published hunting queries (OAuthAppInfo, service-principal sign-in and Graph audit events).
Assess impact on backup and restore workflows while the service is down.

Strategic

Enable Graph activity logging where licensing allows.
Alert when an app self-assigns a privileged role, grants a role to a sibling principal, or adds credentials.
Inventory app identities with permissions, named owners and credential-change dates; apply least privilege to multi-tenant apps.
Rehearse revoking application access as part of incident response.

Questions to ask your team / vendors

Which third-party apps hold tenant-wide application permissions or directory roles, and who owns each one?
Can we see what data an app-only token read? If not, what logging closes that gap?
Vendors: how are your multi-tenant app credentials stored and rotated? Will you notify us within hours if they are exposed?
Has the vendor verified that its rotation actually ended the attacker's access, and what is its root-cause finding?
How fast can we revoke an app's access across all tenants we manage?

Sources

Discuss: Do you treat consented SaaS apps as privileged identities, with owners, access reviews and revocation drills? If not, what is stopping you?

Do you know which SaaS apps hold admin consent in your tenant?

CISO Platform members are swapping the Entra ID queries and app-consent review processes they used after Storm-0940. Join to get the peer playbook and the Monday threat briefing.

Join CISO Platform (free for security leaders) →

All Articles