ConnectWise Cloud Backup / identidade de app… · Breach

Storm-0940 used ARTEX AI against more than 2,250 Microsoft 365 tenants

Oct 16, 2026 · 1 min read

Microsoft attributed the abuse of ConnectWise Cloud Backup application credentials in a cross-tenant token sweep to the China-linked Storm-0940 group. Using AI agents from the ARTEX framework, the attackers attempted authentication against more than 2,250 Microsoft 365 tenants and established persistent privileged access at numerous organizations; ConnectWise shut down the affected services and disabled the apps. Companies should rotate vendor application credentials and secrets, review app consents, and hunt for planted secrets.

By HIFY Radar newsroom Updated 10/26/2026 01:25 PM Get this every day →← Back to the feed 7 sources

HighBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

ConnectWise Cloud Backup application credentials were compromised and used in access attempts against customer Microsoft 365 environments; Microsoft puts the figure at more than 2,250 tenants targeted. Microsoft attributed the attack to the China-linked Storm-0940 group using AI agents from the ARTEX framework. ConnectWise shut down its Cloud Backup, SaaS Security, and Cloud Management services and disabled the affected apps on October 17.

Why it matters

Attackers leveraged permissions customers had already granted to ConnectWise, with no interactive user login, and established persistent privileged access at numerous organizations. Microsoft has not disclosed how many customers were compromised or whether data was stolen, and Microsoft Graph directory reads leave no audit record. In some cases the attack moved from initial targeting to privileged cloud access in under three hours.

What to do

Rotate credentials and secrets for all vendor applications in Microsoft 365 and audit for planted secrets on other apps in the tenant. Review consents and permissions, disable unused ConnectWise apps, and check October sign-in logs, especially October 15. Verify whether any application received an unauthorized Global Administrator grant.

For the technical team

Affected: ConnectWise Cloud Backup / identidade de app Microsoft 365 · ConnectWise Cloud Backup, SaaS Security, and Cloud Management services (shut down); ConnectWise/SkyKick family applications in Microsoft 365 and Entra ID. More than 2,250 Microsoft 365 tenants targeted (Microsoft). Huntress found nearly 1,000 Entra tenants with sign-in activity from the primary IP, over 300 successful.
Exploitation: Confirmed exploitation. Microsoft (October 21 report) attributed it to Storm-0940, a China-linked espionage crew active since at least 2021, using the ARTEX framework; attempts reached 2,900 per minute. Huntress observed post-compromise activity in two tenants: the application granted itself Global Administrator and planted secrets on other tenant-registered apps within about two minutes around 03:45 UTC on October 15; persistence survives revocation of the original credential. Last confirmed successful sign-in: 08:44 UTC on October 15. No evidence of mailbox or file manipulation or user/policy changes in the reviewed tenants; Graph directory reads leave no audit record.
Fix: No patch. ConnectWise shut down the affected services and, on October 17, communicated it had disabled the relevant apps; CEO Manny Rivelo said the affected application connections were contained and services are being gradually restored. Per-tenant mitigation: revoke and rotate application credentials and secrets, remove planted secrets, review consents and permissions, disable unused ConnectWise apps, and review sign-in logs.
Vector: Abuse of the ConnectWise Cloud Backup application identity (service principal): compromised vendor credentials authenticated across Microsoft 365 tenants without interactive user login, leveraging permissions customers had already granted to ConnectWise apps. Application sign-ins seen from 144.172.64[.]128 (AS14956, RouterHosting); the access that planted credentials on other apps came from private Azure IPv6 space. A prior password spray (October 10 to 14) made more than 151,000 failed attempts against 327 accounts at eight organizations, with no successful logins, per Microsoft.
More details: ARTEX is an open-source autonomous penetration-testing framework written in Go, published on GitHub by a Chinese developer in July 2026, winner of Baidu's 'Agent+' red team challenge in September, and made closed-source on October 8 with more than 12,000 forks (Wiz). Microsoft says Storm-0940 has used ARTEX since September against government agencies, defense contractors, banks, manufacturers, and tech firms, and that actors from several regions also use it. Wiz observed the same actor targeting other IT and software vendors and identity providers (Okta, Entra, AWS Cognito) with coordinated password spraying (one-second median gap, 20 to 60 minute bursts, 24 to 30 hour sessions) focused on software engineer accounts. A second targeted wave on October 15 unsuccessfully hit 16 Huntress-protected tenants in the policy, national security, trade, and critical mineral sectors: a Graph token sweep from the SkyKick app between 09:25:04 and 12:35:50 UTC and a manual wave between 13:54:39 and 14:20:24 UTC against Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and Office 365 Management APIs. Huntress also reports the actor planted a credential on a Huntress application in one customer tenant, used seven times and removed on October 16. ConnectWise previously disclosed a 'sophisticated nation-state actor' breach via ScreenConnect in May 2025; nothing suggests the two attacks are linked.