---
title: ConnectWise Cloud Backup M365 app abuse: Microsoft attributes Storm-0940 using ARTEX agentic AI; app still the containment focus | ctxsec
url: https://ctxsec.com/items/connectwise-cloud-backup-m365-credential-abuse
description: ""
status: "confirmed (ConnectWise + Huntress + Microsoft Threat Intelligence Oct 21), last updated 2026-10-21"
published: 2026-10-17
updated: 2026-10-21
---

> 

[← Cybersecurity News](/news) · [markdown](/items/connectwise-cloud-backup-m365-credential-abuse.md)

confirmed (ConnectWise + Huntress + Microsoft Threat Intelligence Oct 21)

2026-10-17 · updated

2026-10-21

### ConnectWise Cloud Backup M365 app abuse: Microsoft attributes Storm-0940 using ARTEX agentic AI; app still the containment focus

**Update Oct 21 (~2:30 PM ET): Microsoft Threat Intelligence** attributes the ConnectWise multi-tenant application compromise to China state-aligned **Storm-0940**, which used the open-source agentic AI pentest framework **ARTEX** from as early as September 2026. MS says ARTEX automated scanning, password spraying and OAuth app abuse against hundreds of organizations across many industries, with several cases reaching privileged cloud access in under three hours. During the ConnectWise incident, Storm-0940 used ARTEX to reach more than **2,250 tenants** at up to **2,900 sign-in attempts per minute**. A related password-spray wave Oct 10–14 from 144.172.64[.]99 hit 327 accounts across eight orgs (151k+ failures) with no successful auth observed in that spray. Follow-on Graph activity included reconnaissance, application credential changes and privilege modifications. MS publishes additional IOCs (144.172.64[.]60/99/128, python-urllib/3.12 and python-requests UAs, azure-toolkit/1.0, curl/7.88.1) and Defender/Sentinel hunting queries. Presence of the apps or a successful auth does not by itself prove data access. See also the earlier GMO Ierae ARTEX reporting on Japanese targets.ConnectWise says it found unauthorized access to application identities in its Cloud Backup environment and, as of 1:01 a.m. EDT Oct 17, is shutting off Cloud Backup application access, which interrupts backups until further notice; it says it has no indication partner backup data was compromised. Huntress reports the app's client-assertion credential was used from 144.172.64[.]128 on Oct 15 (06:13–08:34 UTC) to get Microsoft Graph tokens, with unauthorized sign-ins confirmed in 162 tenants as of 19:00 UTC Oct 16. In one tenant a second ConnectWise app (Cloud Management - MS Teams) made itself Global Administrator and added client secrets to an MSP management app and to Huntress's own app. Huntress hasn't confirmed data access and notes Graph directory reads leave no audit trail. Update (Huntress, Oct 17 10:30 a.m. ET): Huntress has high confidence the attacker also abused the ConnectWise Cloud Management - Exchange Online, MS Teams and SharePoint Online apps, which didn't appear to be disabled by ConnectWise at that time. It also says early activity seemed to target tenants alphabetically, starting with 'A'. Update (BleepingComputer Oct 17 ~11:18 a.m. ET): Microsoft confirmed unauthorized authentication attempts from 144.172.64[.]128 starting Oct 15 and characterized the event as an active supply-chain attack abusing existing app permissions (including Directory.ReadWrite.All). ConnectWise announced service interruption at 05:01 UTC Oct 17; Huntress support later emailed partners Tenant IDs/names for affected tenants and reiterated disable-not-delete for app ID 506e08f9-6e9a-4da4-942b-a099a03644ae. Update (Huntress, Oct 17 5:15 p.m. ET): ConnectWise says it has now disabled the relevant apps. Huntress found sign-in activity from 144.172.64[.]128 in nearly 1,000 Entra tenants, more than 300 of them successful, though access failed where the ConnectWise service principal wasn't installed. It also found a second, targeted wave on Oct 15 against 16 Huntress-protected tenants in the policy, national security, trade and critical-minerals sectors. Most of those don't use ConnectWise, and the attempts failed. That wave's first sweep (09:25–12:35 UTC) went after Graph tokens through the SkyKick app. The second, which looked manual (13:54–14:20 UTC), targeted Exchange Online, SharePoint, Teams, Azure Resource Manager, Entra and the Office 365 Management APIs. The credential added to Huntress's own app was added from private Azure IPv6 space, not 144.172.64[.]128, so IP-only hunts can miss it. Huntress advises auditing service principal sign-ins to the ConnectWise apps from about 01:00 UTC Oct 15 to 02:00 UTC Oct 16. Update (ConnectWise Trust Center, Oct 18 01:00 UTC / Oct 17 9:00 p.m. ET): ConnectWise says it disabled seven application identities at 07:00 UTC Oct 17 (Cloud Backup plus six Cloud Management apps) and revoked the certificates behind them, so the shared Cloud Backup credentials no longer work. It warns that access tokens already issued may keep working until they expire, and disabling doesn't undo changes already made inside tenants. As a precaution it has also taken SaaS Security and Cloud Management offline, so SaaS Security monitoring and alerting and Cloud Management user and license management are unavailable. Cloud Backup stays suspended with no restoration time, and ConnectWise says it has no evidence the encrypted archives were accessed. It asks partners to review every MSP and customer tenant, including dormant SkyKick connections, from Oct 13 onward (back to Oct 1 where logs allow). The review covers app credentials, federation trusts, roles, consent grants, policy changes, and mailbox forwarding, inbox/transport rules and delegations. Update (ConnectWise Trust Center, Oct 19 13:45 UTC): containment still in place; ConnectWise says it has not observed successful threat activity in environments it monitors since Oct 17 05:00 UTC. Cloud Backup, SaaS Security, and Cloud Management remain suspended (no scheduled backups, archive access, restores, or Cloud Management license ops). Partners must keep the listed apps disabled and follow the technical investigation/remediation guide until formal restoration instructions. Earlier Oct 18/19 advisory updates also added IOC IPs 144.172.64[.]99 and 144.172.64[.]60 (alongside 144.172.64[.]128) from downstream monitoring. Next ConnectWise update was scheduled by Oct 19 19:00 UTC. Update ([Huntress, Oct 19 1:30 PM ET](https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access)): Huntress found a **second tenant** with post-compromise activity. In both tenants it happened within two minutes around 03:45 UTC on Oct 15, and followed the same script: the application granted itself Global Administrator, then planted a new secret on a few other applications in the tenant to keep a foothold. Huntress saw no signs of mailbox or file changes or user and policy changes, though Graph directory reads may have happened. Across more than 10,000 tenants with ConnectWise applications where it can see logs, only 144.172.64[.]128 and Microsoft-internal ranges produced application sign-ins. Other circulating addresses in the same AS14956 (RouterHosting) range showed only password spraying and failed logins, which Huntress believes are unrelated. ConnectWise's [Oct 18 remediation guide](https://www.connectwise.com/contentassets/10777cd3364d440c86ed5270a94a5f24/connectwise-cloud-backup-technical-investigation-and-remediation-guide-1.pdf) says it disabled seven application identities and revoked their credentials at 07:00 UTC Oct 17, and warns that previously issued tokens may stay usable until they expire and that a replacement vendor credential does not remove anything the attacker added.

Sources: [ConnectWise Trust Center advisory](https://www.connectwise.com/company/trust/advisories) · [Huntress](https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access) · [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/) · [Huntress support (SkyKick)](https://support.huntress.io/hc/en-us/articles/56492265597459-2026-October-SkyKick) · [ConnectWise Cloud Backup investigation and remediation guide (Oct 18)](https://www.connectwise.com/contentassets/10777cd3364d440c86ed5270a94a5f24/connectwise-cloud-backup-technical-investigation-and-remediation-guide-1.pdf) · [Microsoft: Storm-0940 uses ARTEX agentic AI in ConnectWise supply-chain compromise](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/) · [Microsoft on X (MsftSecIntel)](https://x.com/MsftSecIntel/status/2112975078266716390)