ConnectWise shuts down Cloud Backup after a compromised app credential was used to sign in to Microsoft 365 tenants

TLDR

• Microsoft attributes the ConnectWise Cloud Backup attack to China-state aligned actor Storm-0940, using AI penetration-testing tool ARTEX.⁷⁸
• Microsoft says ARTEX attempted sign-ins to more than 2,250 tenants; it does not say how many were compromised.⁷⁸
• ConnectWise began phased service restoration on 21 October and expects recovery to take several days.⁸

ConnectWise's Cloud Backup is a backup and recovery service that managed service providers (MSPs) use to protect their clients' Microsoft 365 or Google Workspace data, and it is granted broad access to mailboxes, OneDrive, SharePoint, Teams and directory data in each tenant where it is installed, according to The Hacker News.² BleepingComputer reports that administrators began flagging unauthorised access on Friday 16 October, and that ConnectWise, in a security advisory, said it had "recently identified unauthorized access to application identities within the ConnectWise Cloud Backup environment" and shut down application access for partners and clients.³ BleepingComputer also reports that Microsoft confirmed malicious activity involving the service, citing unauthorised authentication attempts from the same IP address on 15 October.³

Huntress says the credential was used to obtain Microsoft Graph tokens in customer tenants on 15 October between 06:13 and 08:34 UTC, with the actor moving through tenants in sorted order a few seconds apart, which it says points to a script working from a target list.² BleepingComputer, citing Todyl, reports that the attacker authenticated directly to Microsoft 365 as the backup application using its secret, gaining the permissions customers had already granted it.³ At the time of these three reports, none named an actor or said how the credential was obtained; Microsoft attributed the attack on 21 October (see the 22 October update). Huntress also reports the same IP address password-sprayed four law-firm tenants on 13 and 14 October without a successful user sign-in in its telemetry.²

In an update on 17 October, Huntress said ConnectWise had by then disabled the relevant apps, and described a second, targeted wave on 15 October against 16 Huntress-protected tenants in the policy, national security, trade and critical-minerals sectors. Most of those tenants do not use ConnectWise products, and the attempts failed because the application was not present in them.¹ In one partner tenant, Huntress says a second ConnectWise app gave itself the Global Administrator role and added new credentials to two other applications.¹ Its guidance is to disable, not delete, the Cloud Backup app (application ID 506e08f9-6e9a-4da4-942b-a099a03644ae) and the ConnectWise Cloud Management - MS Teams app (24205314-2b89-4e07-a2a4-579e898a5640), to review the credentials on every Microsoft 365 application because disabling does not remove credentials already added, and not to re-enable the apps until ConnectWise confirms all credentials have been reset.¹

Why it matters: one vendor-held secret was valid across every tenant that had consented to the app, so the exposure runs through customers of MSPs rather than any single victim, and Microsoft's account of AI-driven sign-in attempts against more than 2,250 tenants means each tenant needs a credential review, not just disabling the ConnectWise apps.¹⁷

Update, 20 October 2026: Sophos X-Ops, which identified the activity on 15 October, says one virtual private server authenticated as the Cloud Backup application and requested app-only Microsoft Graph tokens from consenting tenants for about 96 minutes, from 07:11 to 08:47 UTC, with no user password or multi-factor authentication involved.⁴ Sophos found no hands-on-keyboard activity, says tenants were accessed in ascending tenant-ID order one to six minutes apart, and says the sweep included tenants with no active backup subscription, which it reads as a script working from a full list of consenting tenants.⁴ The Hacker News, reporting Huntress's findings, gives a different period, 06:13 to 08:34 UTC with tenants a few seconds apart.² Sophos says it is unclear how the credential was obtained or what the actor did with the tokens, and that it saw no new secrets, applications, consents or role assignments in the tenants it reviewed.⁴ It advises reviewing Entra sign-in logs for 15 to 17 October and audit logs for new credentials or role assignments since 13 October.⁴

The Register reports that ConnectWise's advisory of 16 October said it identified the unauthorised access on 15 October, and that the SaaS Security and Cloud Management services were also suspended because they are integrated with Cloud Backup.⁵ As of 16:00 UTC on 18 October those services were still unavailable, so customers could not back up, access or restore data.⁵ According to The Register, ConnectWise's vice president of security operations wrote on Reddit that existing archives remain encrypted, isolated and preserved with no evidence of unauthorised access, and the company says it cannot discuss attribution.⁵ A ConnectWise spokesperson told Cybersecurity Dive there is no evidence that partner backup data was compromised.⁶

Cybersecurity Dive reports that Microsoft Threat Intelligence said on Saturday it was tracking an active supply-chain attack involving a compromised trusted OAuth app for Cloud Backup, assessed that the actor likely abused permissions customers had previously granted, and saw Graph API reconnaissance and attempts to add credentials as a backdoor.⁶ It also quotes Huntress as saying that, from a separate hosting address, the actor tried to sign in to more than 1,000 Huntress-protected Microsoft 365 accounts and succeeded on more than 300, and says Todyl confirmed impact from the same attack.⁶ Cybersecurity Dive gives the source IP address in Microsoft's post as 142.172.64[.]128, while Sophos gives 144.172.64[.]128.⁴⁶

Update, 22 October 2026: Microsoft has attributed the attack on ConnectWise's Cloud Backup application to a China-state aligned actor it tracks as Storm-0940. In a blog post on 21 October, Microsoft Threat Intelligence says it assesses that Storm-0940 was responsible for the ConnectWise supply chain compromise, and describes the actor as active since 2021, with no known industry aliases, and as targeting organisations across multiple industries for data theft.⁷ CyberScoop reports the same attribution.⁸ ConnectWise has said it cannot discuss attribution, as The Register reported earlier.⁵

Microsoft says Storm-0940 used ARTEX, an open-source, multi-agent penetration testing framework that can drive any AI model, to automate scanning and reconnaissance, password spraying and OAuth application abuse against downstream victims during the ConnectWise compromise.⁷ It says the actor used ARTEX to attempt sign-ins to more than 2,250 tenants at 2,900 sign-in attempts per minute, and that in some environments the AI agents went on to Microsoft Graph and directory operations, including reconnaissance, application credential changes to establish persistence, and changes involving identities, groups and privileged roles.⁷⁸ That tenant figure counts attempted sign-ins and sits alongside the lower counts of confirmed sign-ins reported earlier by Huntress and Cybersecurity Dive.¹²⁶⁷ Microsoft says the presence of an affected application or a successful authentication does not necessarily mean customer data was accessed or exfiltrated, and CyberScoop notes Microsoft did not say how many customers were compromised.⁷⁸ Microsoft also says the activity did not result from a compromise of, or a vulnerability in, its own systems, products or services.⁷

Microsoft links the campaign to earlier activity. It says infrastructure at 144.172.64[.]99 ran an automated cross-tenant password-spray campaign from 10 to 14 October against 327 accounts at eight organisations, with more than 151,000 failed logons peaking at 2,900 failures a minute on 11 October, and that it observed no successful authentication, token issuance, Graph call or directory change in that campaign.⁷ Microsoft says ConnectWise's 16 October advisory later listed an indicator matching that same address, and that the AI agents then used the same IP range to authenticate to customer environments with the stolen application credentials.⁷ Earlier reports give the sign-in address as 144.172.64[.]128 (Sophos and Huntress) or 142.172.64[.]128 (Cybersecurity Dive).¹⁴⁶

On recovery, CyberScoop reports that ConnectWise, which shut down services on Saturday 17 October, began restoring them in phases on Wednesday 21 October, advised customers to keep connections disabled and expects recovery to take several days.⁸ Microsoft advises customers to review service principal sign-ins, investigate unexpected application credential or privilege changes and follow ConnectWise's published containment guidance while preserving evidence, and says Microsoft Defender XDR provides detections and hunting queries.⁷