Full Breakdown
Chinese-linked Hackers Exploit ConnectWise Cloud Backup to Access Hundreds of Microsoft 365 Tenants
By Drooid · · How we work
Core Incident Overview
In a supply-chain attack disclosed in late October 2026, a Chinese state-aligned group tracked by Microsoft as Storm-0940 used the AI-driven framework ARTEX to steal application credentials from ConnectWise Cloud Backup (formerly SkyKick Cloud Backup). The credentials let the attackers authenticate as a trusted service principal in customer Microsoft 365 environments, compromising at least 162 Microsoft 365 tenants. ConnectWise suspended its Cloud Backup and Cloud Management services while investigations continue. No evidence shows backup archives were accessed or exfiltrated.
Background & Context
ConnectWise provides backup and management services for Microsoft 365 tenants, allowing managed service providers (MSPs) to protect email, files, Teams chats, and directory data. The service relies on application credentials (client secrets) that have broad permissions across customer tenants and bypass user-based multi-factor authentication (MFA).
Timeline of Key Events
- Oct 13, 2026 – Automated sign-in attempts from IP 144.172.64.128 targeting Microsoft Entra tenants.
- Oct 14 – ConnectWise detects unauthorized access.
- Oct 15 – Attackers use the compromised credential to access at least 162 tenants.
- Oct 17 – ConnectWise disables the compromised application identities and suspends Cloud Backup.
- Oct 18 – Ongoing investigations; service restoration timing unannounced.
- Oct 21 – Microsoft publicly attributes the campaign to Storm-0940 and describes ARTEX’s role in achieving privileged cloud persistence.
Data & Statistics
- 162 Microsoft 365 tenants confirmed compromised (Huntress).
- About 1,000 Entra tenants recorded sign-in activity from the malicious IP; ~300 succeeded.
- A second manual wave targeted 16 tenants in policy, national-security, trade, and critical-minerals sectors; all attempts failed.
- The attack leveraged multiple application IDs, including 506e08f9-6e9a-4da4-942b-a099a03644ae (ConnectWise Cloud Backup).
Official Statements & Responses
- Microsoft said the group used ARTEX to automate reconnaissance and achieve “privileged cloud persistence.”
- ConnectWise alerted that compromised connections were revoked, Cloud Backup remained suspended, and no archive compromise was found.
- The Chinese Embassy in Washington did not respond; Beijing regularly denies involvement in cyber-enabled data theft.
Impact and Operational Risks
The breach creates operational risk for MSPs and downstream customers that rely on ConnectWise for disaster recovery. Service suspension stops new backups and restores, but changes made before credential revocation may persist in tenant environments. The incident highlights how application-level authentication can bypass MFA, exposing a supply-chain vulnerability in third-party cloud services.
Conflicting Reports & Gaps
- Attribution: Microsoft and Reuters attribute the attack to a Chinese state-aligned group (Storm-0940).
- Scope: Huntress confirms 162 compromised tenants; ConnectWise has not disclosed the full potential impact.
Mitigation Guidance
Critical steps for organisations using ConnectWise services:
1. Disable the affected ConnectWise applications in Microsoft Entra, especially application ID 506e08f9-6e9a-4da4-942b-a099a03644ae.
2. Review all application credentials, secrets, and certificates for unauthorized additions since Oct 13 and revoke suspicious entries.
3. Examine sign-in and audit logs for activity from IP 144.172.64.128 and user agents such as python-urllib/3.12 and curl/7.88.1.
4. Audit directory roles, consent grants, and policy changes for signs of privilege escalation.
5. Preserve relevant logs before remediation actions that might overwrite evidence.
These actions aim to contain the breach, prevent further persistence, and restore confidence in cloud-based backup operations.