What happened

On October 21, 2026, Microsoft Threat Intelligence published its account of the incident that knocked ConnectWise's Microsoft 365 backup service offline the week before. The report attributes the activity to Storm-0940, which Microsoft describes as "a China-state aligned actor" active since 2021, and says the group ran much of the operation through ARTEX, an open-source penetration testing framework that can drive any AI model through an attack from reconnaissance to data exfiltration.

The way in was not a Microsoft bug. Storm-0940 held a stolen Microsoft 365 API secret belonging to ConnectWise Cloud Backup, the MSP backup product formerly sold as SkyKick. Because MSPs had consented that multi-tenant app into their customers' tenants, one secret came with trust already granted in every one of them. Microsoft counts "more than 2,250 tenants" targeted with sign-in attempts at up to 2,900 per minute. Those are tenants targeted, not confirmed breaches. Nobody has published a verified count of compromised tenants yet.

Microsoft is explicit about its own exposure: the activity "did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services." Neither company has disclosed how the Cloud Backup secret was stolen.

Why it matters

Two things are new. The first is speed. Microsoft saw "multiple instances where the time from initial targeting to privileged access was less than 3 hours," with reconnaissance, credential additions and privilege-change attempts all running faster than a person at a keyboard could manage. Yih Khai Wong of IDC put it bluntly to CSO Online: "2,900 sign-in attempts per minute and gaining privileged cloud access in under three hours is not a timeline any human analyst queue can keep up with."

The second is the target. Most Microsoft 365 hardening goes into people: MFA, conditional access, phishing-resistant keys. A backup app's service principal signs in with a secret, often holds tenant-wide Graph permissions, and is rarely watched as closely as a user account. "Companies spend enormous amounts of time securing employee logins with MFA and conditional access, while third-party applications can hold equally powerful permissions," Yash Kadakia of Security Brigade told CSO. An agent that can work through thousands of tenants overnight turns that blind spot from a one-off risk into a bulk one.

ConnectWise CEO Manny Rivelo framed it the same way in a statement quoted by Cybersecurity Dive: "Nation-state actors are increasingly targeting the software supply chain, because one trusted connection can open the door to many organizations. AI now lets them test those connections at what Microsoft calls 'machine speed.'"

How the attack worked

Microsoft describes ARTEX as a "multi-agent LLM system written in GO with a Next.js frontend" that can run autonomous penetration tests with minimal human intervention. It is model-agnostic, so the operator picks which model drives it. CSO Online reports that the same framework was linked earlier in October to data breaches at Korean financial institutions.

With the Cloud Backup credential in hand, the attacker used a second ConnectWise app, Cloud Management - MS Teams, to grant Global Administrator access and add credentials to other applications, according to The Register. That is the step defenders should care about most. A new secret added to an existing app keeps working after the original stolen credential is revoked.

Microsoft also tied Storm-0940 to a separate password-spray run between October 10 and 14 that hit 327 accounts across eight organizations and produced more than 151,000 failed sign-ins, peaking on October 11 at 2,900 failures per minute. Targeted sectors range from aerospace and defense, energy, government and semiconductors to law firms, media and think tanks. Huntress, which investigated affected MSP tenants and published its own write-up, told Cybersecurity Dive that "our working hypothesis is that these attacks were conducted by an AI agent leveraging scripted tooling, with occasional human intervention."

Where ConnectWise stands

ConnectWise's advisory gives the timeline. It was first posted on October 16 at 17:47 UTC. Three services were suspended on October 17 (Cloud Backup, SaaS Security and Cloud Management), and seven application identities were disabled at 07:00 UTC that day. Phased restoration began on October 20 at 00:45 UTC. As of October 22, 2026, the latest update says restoration "is underway, with each step subject to security validation" and will "take several days." The company says existing backup archives "remain encrypted, isolated, and preserved, with no evidence of unauthorized access."

Partners are told to keep the affected connections disabled until ConnectWise issues formal instructions. These are the seven identities, as listed by ConnectWise and republished by eSentire.

One limit is easy to miss. ConnectWise does not manage the relationship between MSPs and their end customers, so it cannot tell which customer tenants were touched. Rivelo also cautioned, as reported by The Register, that switching off the app connections does not by itself evict an attacker who already has a foothold. That investigation falls to each MSP and each tenant admin.

What Microsoft 365 admins and MSPs should do now

Microsoft's guidance puts evidence before cleanup. Disable the ConnectWise app connections, but export the enterprise application configuration before deleting anything, and record the application IDs and service principal Object IDs your tenant holds for them. Then work through the logs.

1. Preserve Entra sign-in and audit logs, Purview Audit and SIEM records before retention rolls them off.
2. Review activity from at least October 15, 2026, and back to October 1 where your logs reach.
3. Analyse successful and failed service principal sign-ins separately. One quiet success matters more than a thousand loud failures.
4. Hunt for credentials added to existing apps, new apps or service principals, and new role assignments, Global Administrator above all.
5. Revoke permissions the ConnectWise apps did not need, rotate any credentials they could reach, and apply least privilege to every multi-tenant app.

Defender XDR customers get detections plus hunting queries against OAuthAppInfo, service principal sign-in and Graph API audit events, and Key Vault secret reads. Microsoft's report also lists attacker IPs (144.172.64.128, 144.172.64.99, 144.172.64.60, 187.15.88.186, 187.15.89.186 and 187.15.90.217) and user agents including python-requests/2.31.0, Python-urllib/3.12, curl/7.88.1 and azure-toolkit/1.0. For a tenant-by-tenant walkthrough, SpecterOps published a checking guide on October 17.

What's next

ConnectWise's three services are still coming back in stages, and partners should expect to reconnect them only once formal instructions arrive. Two questions remain open: how the Cloud Backup secret was taken, and how many of the 2,250-plus targeted tenants were actually entered. Neither company has answered either. This is also not ConnectWise's first supply-chain scare. Its ScreenConnect remote-access product was breached in May 2025, though no link between the two incidents has been confirmed.

The wider shift is harder to undo. Any vendor app holding tenant-wide permissions across hundreds of customers is now something an AI agent can work through in an afternoon. If your tenant still consents to an MSP tool you stopped using, this week is the time to remove it.