Pulp-style illustration of a brass relay station with a glowing red port sending a swarm of drones towards domed cities

ConnectWise Cloud Backup: Storm-0940 and an AI-paced supply-chain attack

ALERT · Mitigated. Last updated 23 October 2026. See the Alert Tracker

Microsoft has tied the ConnectWise Cloud Backup compromise to Storm-0940, a China-aligned actor that used an agentic AI penetration testing framework to work through stolen app identities at machine speed. If you ever installed the integration, the clock on your logs is already running.

What happened

ConnectWise published its first advisory on 16 October 2026 about unauthorised access involving Cloud Backup, the product formerly known as SkyKick. Its technical investigation and remediation guide, dated 18 October, says that at 07:00 UTC on 17 October it “disabled the seven application identities listed below and revoked the associated credentials”.

On 21 October Microsoft Threat Intelligence put a name to it: “Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application.” Microsoft describes Storm-0940 as China-state aligned, active since 2021, and fond of password spraying and of adding credentials to existing OAuth applications.

Why the AI part matters

The tool here is ARTEX, which Microsoft describes as an open-source, multi-agent penetration testing framework that can run “from reconnaissance through data exfiltration with little needed human interaction.” Microsoft says Storm-0940 used it from as early as September 2026 against hundreds of organisations, with “multiple instances where the time from initial targeting to privileged access was less than 3 hours.”

After taking control of the ConnectWise app identities, Microsoft says, the actor attempted to sign in to more than 2,250 tenants; Microsoft’s figures include more than 200 app sign-ins in under four minutes using four application credentials. That pace is the point. A supply-chain compromise used to give defenders days of slow, human-paced follow-on activity. Here the follow-on ran at machine pace.

Before that, according to Microsoft, between 10 and 14 October, infrastructure at 144.172.64[.]99 sprayed 327 accounts across eight organisations, producing more than 151,000 failed logons, peaking at 2,900 failures a minute on 11 October. Microsoft says none succeeded. The noisy part failed; the quiet part, using apps customers had already trusted, didn’t need to guess any passwords.

What the actor did in tenants

In some environments, according to Microsoft, the activity went beyond sign-in to Microsoft Graph reconnaissance, application credential changes and changes to identities, groups and privileged roles. One detection describes an application that “assigned itself to a high privilege role”. Microsoft maps this to ATT&CK techniques including T1195 (supply chain compromise), T1098.001 and T1098.003 (added cloud credentials and roles) and T1528 (stealing application access tokens).

Both companies are careful to say that a matching sign-in is not proof of data theft. Microsoft is equally clear that credentials added by the actor “can remain active as a backdoor even after the original compromised application is mediated [sic].”

What to do

  1. Export your logs now. ConnectWise notes that Entra normally keeps audit and sign-in records for seven days on Free and 30 days on P1/P2, and that “A license upgrade does not recover expired history.” If your tenant is on Free, the earliest activity is already gone or about to be.
  2. Find the apps by ID, not name. ConnectWise lists seven application client IDs (in its remediation guide), and older installs may show SkyKick names. Microsoft’s hunting queries cover three of them, although its text refers to four. Use ConnectWise’s full list.
  3. Keep the connections disabled, and don’t delete them first. Both vendors say to preserve configuration and evidence before any irreversible change.
  4. Review service principal sign-ins from 13 October, extending back to 1 October where records exist. Filter on 144.172.64.128, .99 and .60, but don’t stop at the published addresses.
  5. Audit what changed. Look for new credentials on applications or service principals, new app-role assignments and consent grants, privileged role assignments, and changes to Conditional Access, mail forwarding and mailbox permissions.
  6. Then clean up: remove unauthorised credentials, grants and assignments, and rotate anything the app could reach.

The wider lesson

Every multi-tenant app with standing Graph permissions is a key held by somebody else. This one was held by a backup vendor, which is about as trusted as it gets. A periodic review of which third-party apps hold application permissions in your tenant, and whether anyone still uses them, is cheaper than this week’s incident response.

The same pattern, an agent trusted with real permissions, runs through four recent AI agent advisories where prompt injection became code execution. More on exploited flaws and supply-chain attacks is in Threats & Vulnerabilities.

Sources