ConnectWise (SkyKick) breach: how Storm-0940 used AI agents to reach Microsoft 365

What happened in the ConnectWise breach

ConnectWise Cloud Backup, sold as SkyKick until ConnectWise bought it, backs up Microsoft 365 for managed service providers (MSPs) and their customers. To do that, its app holds broad permissions in every tenant that installed it: mail and attachments, OneDrive and SharePoint files, Teams chats and directory data, as Todyl describes the consent.

In mid-October 2026 someone else held that app's credential. Huntress saw it used on 15 October from a hosting provider address, 144.172.64.128, to obtain Microsoft Graph tokens in customer tenants. Legitimate traffic from the app comes from Azure's private address space. ConnectWise confirmed "unauthorized access to application credentials and identities associated with Cloud Backup", shut off the app's access on 17 October and suspended Cloud Backup, SaaS Security and Cloud Management.

On 21 October, Microsoft attributed the campaign to Storm-0940, a "China-state aligned actor" active since 2021 whose main objective is data theft. Microsoft says the threat actor used ARTEX, an open-source framework of AI agents, to speed up every step, from finding targets to changing settings inside the tenants it reached.

This is a supply chain attack: the victims never typed a password. A vendor's credential, trusted by every tenant that had installed the app, did the work.

Short on time? Go straight to the Microsoft 365 checklist.

The ConnectWise breach at a glance

ConnectWise breach: what to check in Microsoft 365 now

If ConnectWise Cloud Backup, SkyKick or ConnectWise Cloud Management was ever installed or consented in a tenant you run, work through this list. It combines the guidance from Microsoft, ConnectWise, Huntress and Todyl.

1. Export the logs today. Entra ID keeps sign-in and audit logs for 30 days on P1 and P2 and for seven days on the free tier, according to Microsoft's retention reference. On paid tenants the records from 1 October start to expire at the end of October and those from 15 October around 14 November. On free tenants the 15 October records are already gone unless someone exported them; the Microsoft 365 unified audit log in Purview has its own retention and may still hold the mail and file events. Do not let the export hold up containment.
2. Disable the apps, do not delete them. In Entra ID, set "Enabled for users to sign-in" to No on each affected enterprise application. Deleting removes the consent, means a fresh consent later and destroys configuration you need as evidence.
3. Find every copy by application ID, not by name. Check tenants where the app was installed but never used. ConnectWise's advisory lists the further Cloud Management apps (Exchange Online, SharePoint Online, Partner Center); these are the IDs in Microsoft's hunting queries:
   • ConnectWise Cloud Backup (formerly SkyKick): 506e08f9-6e9a-4da4-942b-a099a03644ae
   • ConnectWise Cloud Management, MS Teams: 24205314-2b89-4e07-a2a4-579e898a5640
   • ConnectWise Cloud Management, MS Graph: 0de14c77-b9b0-4137-9360-34878a929827
4. Read the service principal sign-ins. In Entra ID, open Sign-in logs and switch to the Service principal sign-ins tab; the default user view shows nothing here. Filter on the application IDs, review from 1 October, and look for any address outside Microsoft and Azure ranges. Microsoft and ConnectWise name 144.172.64.128, 144.172.64.99 and 144.172.64.60 as a starting point, not a complete list. Review failed and successful sign-ins separately.
5. Remove credentials you did not add. Check every enterprise app and app registration for client secrets or certificates created since 13 October, above all on management and security tools. Remove any you cannot explain and tell the vendor of any security tool that was touched. Huntress found added secrets set to expire in 2028, so they would outlive the vendor's own reset.
6. Check directory roles. Remove Global Administrator, Exchange Administrator, Privileged Authentication Administrator or any other role an app holds that you did not grant on purpose. The alert to look for is an app adding itself to a role.
7. Check Key Vault. If the app or a role it gained could reach Azure Key Vault, review vault access for the period. Microsoft saw bulk secret reads across multiple vaults; rotate what was stored there.
8. Review mail and file activity. Look for unusual mailbox access, new forwarding or inbox rules, delegated permissions, bulk downloads and SharePoint enumeration in the Microsoft 365 audit log. Turn on Microsoft Graph activity logs if you have Entra ID P1 or P2; collection starts on the day you enable it, so it helps with what comes next and not with the past.
9. Keep the apps off until ConnectWise says otherwise. Backups pause while the app is disabled; ConnectWise says existing backups are not deleted. Follow its reconnection steps when onboarding opens.

MSPs: run the checks in each customer tenant, tell each customer in writing which apps were present and what you found, and check your contracts and the notification duties that apply to you. If you find a role, credential or mailbox rule you cannot explain, this is an incident: widen the scope to everything that identity could reach and follow your incident response plan. ConnectWise takes reports of suspicious activity at [email protected].

Timeline of the ConnectWise breach

Times are UTC and come from the source named in each entry.

• Early September. Storm-0940 starts using ARTEX in automated attacks against hundreds of organizations (Microsoft).
• 8 October. The ARTEX developer says the tool has been abused and that the project will stop being updated and go closed source (The Record).
• 10 to 14 October. A password spray from 144.172.64.99 hits 327 accounts at eight organizations, peaking on 11 October at 2,900 failures per minute and more than 111,000 failures that day. Microsoft observed no successful sign-in from it (Microsoft).
• 13 and 14 October. A spray from 144.172.64.128 against four law firm tenants locks out two accounts, with no successful sign-in (Huntress).
• 15 October, from 01:58. Cloud Management service principals assign themselves directory roles, mostly Exchange Administrator, in about 50 tenants (Huntress).
• 15 October, 03:44. In one tenant, the Cloud Management Teams app adds itself to the Global Administrator role, then adds client secrets to two other apps, one of them a security vendor's (Huntress).
• 15 October, 06:13 to 08:44. The Cloud Backup credential obtains Graph tokens from 144.172.64.128. 08:44 is the last successful sign-in Huntress confirmed.
• 16 October, 17:47. ConnectWise publishes its first advisory; Huntress publishes its analysis the same day.
• 17 October. 05:01 ConnectWise shuts off Cloud Backup application access. 07:00 it disables seven application identities. 17:00 it revokes certificates for affected connections and brings in an outside incident response firm (ConnectWise).
• 19 October. ConnectWise completes an account and credential reset.
• 21 October. Microsoft attributes the campaign to Storm-0940 and ARTEX. Zscaler publishes its analysis of the wider ARTEX campaign. ConnectWise begins phased restoration.
• 25 October, 14:00. ConnectWise: restoration, testing and security validation continue; phased partner onboarding is targeted for Monday 26 October, with access to restore backups first and full re-enrollment after.

Why MFA did not stop the ConnectWise attack

Most Microsoft 365 defenses are built around people: MFA, Conditional Access for users, sign-in risk, session revocation. None of them applied here.

The attacker used the OAuth client credentials flow with the app's own secret. No user signed in, so there was no MFA prompt to fail. Todyl spells out the consequence: "Revoking user sessions does not end this access." Disabling the app stops new tokens, but tokens already issued "stay valid for up to 90 minutes".

That is the difference from a stolen employee password or session cookie. When an employee's password turns up in a stealer log, you end their sessions and change their password. When an app's credential is stolen, the account to contain is the app's service principal in each tenant: the identity an app gets inside your tenant, listed under Enterprise applications in Entra ID. Its evidence sits in a log most teams never open, the service principal sign-ins.

Persistence followed the same route. Microsoft and Huntress both describe apps granting themselves roles and adding new client secrets to other apps. A secret like that keeps working after the vendor rotates its own credential, which is why the clean-up has to happen in every tenant and not only at ConnectWise.

What is ARTEX, and how did AI agents speed up the attack?

ARTEX is an open-source, multi-agent penetration testing framework, written in Go, that can drive any AI model. Microsoft describes agents that run a test "from reconnaissance through data exfiltration" with little human input and store what they find in a graph.

The tool itself is not new. CrowdStrike, Zscaler and Recorded Future had linked ARTEX to attacks on South Korean financial institutions before this campaign, as SecurityWeek reports. What changed is the pace:

• Spraying. 2,900 failed sign-ins per minute at the peak, and 48 accounts with more than 1,000 failures each. According to Microsoft, account lockouts made up nearly 98% of the responses, so the defenses held there.
• Sweeping. Microsoft's figures show more than 200 sign-ins in under four minutes using four application credentials. Huntress saw the actor move through tenants in sorted order, a few seconds apart, the way a script works through a list.
• Escalating. In multiple cases the time from first targeting to privileged access was under three hours. Microsoft's warning for defenders: "the speed of the activity allows very little time for Defenders to respond."

Zscaler's analysis of the wider ARTEX campaign adds how the operator worked: ARTEX pointed at a DeepSeek model, AI coding assistants configured with DeepSeek, GLM and Grok, one model checking another's findings, and prompts that asked for bulk personal and transaction data and about selling stolen data. Zscaler reads that as a financial motive next to the data theft Microsoft describes.

Nothing here needed a new exploit. With privileged access in under three hours and tenants worked through seconds apart, the window for a person to notice and react is a few hours at most, so the alerts for app credential changes and role assignments have to fire on their own.

ConnectWise breach myths: how many tenants were hit, and was AI the way in?

On X, the ConnectWise breach travelled inside the viral lists of Black October, the run of incidents disclosed in the second half of October 2026. Several of its numbers are being repeated wrongly. Here is what each source says.

• "2,250 tenants hacked." Microsoft wrote that Storm-0940 used ARTEX "to attempt to sign-in to more than 2,250 tenants", and that "the majority of the targeting wasn't successful". It also says the group "achieved privileged cloud persistence at many organizations in a brief time". Both are true at once.
• "2,900 attempts a minute against 2,250 tenants." The 2,900 figure belongs to the password spray against 327 accounts at eight organizations, which Microsoft saw no success from. The tenant sweep used the stolen app credential, not passwords.
• "AI hacked ConnectWise." Microsoft does not say how the app identities were obtained, and neither does Huntress. What the reports show is AI agents abusing the access once someone had it.
• "The backups were stolen." ConnectWise says the backup archives "remain encrypted, isolated and preserved, with no indication of compromise". The risk is the live access to tenants, which did not need the backups.
• "Microsoft 365 was hacked." Microsoft's own service was not breached. The attackers used credentials of ConnectWise's apps, which customers had authorized with tenant-wide permissions.
• "Your tenant is fine if ConnectWise says so." ConnectWise states that its findings "do not establish" whether individual tenants were affected. Each tenant has to be checked by the people who run it.

Beyond ConnectWise: the apps you have already trusted

The lesson reaches every company on Microsoft 365, ConnectWise customer or not. Backup, archiving, e-signature, CRM and security tools often hold tenant-wide, app-only permissions granted years ago by someone who has since left. Each of them is exposed in the same way if its vendor loses a credential.

• Inventory third-party apps with application permissions such as Mail.ReadWrite, Files.ReadWrite.All or Directory.ReadWrite.All, and remove what is no longer used.
• Block new secrets on vendor apps. Application management policies can block or cap password secrets, and their service principal restrictions apply to apps provisioned from another tenant, which is the route this campaign used to keep access. Microsoft notes that the policies do not block tokens for existing apps; they stop new credentials. Fewer people with the Application Administrator role means fewer ways to add one.
• Know the limit of Conditional Access. Conditional Access for workload identities can block service principals outside known IP ranges, but Microsoft says it covers only single-tenant apps registered in your tenant: "third-party SaaS applications, including multitenant apps, are not covered". For vendor apps, permissions and monitoring are the controls you have.
• Alert on the moves this campaign made: credential additions to apps, apps assigned to privileged roles, and app-only Graph activity from new addresses.

What the ConnectWise breach means for leadership mail

Storm-0940's interest is data, and Microsoft names email first: access and exfiltration through Graph, plus forwarding and inbox rules. The sectors on its list include legal and financial services, and Huntress saw the actor spray four law firm tenants before the sweep.

Stolen mail is worth more than the messages themselves. Real threads, real names and real invoice timing are what make business email compromise and CEO fraud convincing. Our breakdown of which exposed data fields make CEO fraud and BEC convincing shows why context beats a spoofed address, and our red team experiment with AI-written CEO messages shows how little effort that context now takes to turn into a believable message.

If your logs show mail access from these apps, treat the mailboxes in scope as disclosed:

• warn finance and assistants that requests may arrive in real threads, and confirm payment and bank detail changes by phone on a known number;
• brief the executives whose mail was in scope, because whaling and pretexting will use what was in it, including private details such as home addresses, family names and travel plans. Those details are often public already; WebThreat's Information Removal specialists file the opt-outs and takedown requests for executives and, on request, their families, verify each removal and re-check every 30 days;
• expect the data to resurface. Zscaler saw the operator ask about selling stolen data, and stolen company data tends to end up on dark web forums and marketplaces, in Telegram channels and in leak databases. EDG3 watches those places for your domain.

The password spray matters too. A spray needs a list of real addresses, and executive addresses are often among the best-known ones in a company. Microsoft says 327 accounts at eight organizations were targeted; whose they were is not public. CEM shows which of your leadership team's current and past addresses already sit in breach data, and our guide to what to do when an executive's password is in a breach covers the next steps.

How WebThreat can help

WebThreat does not investigate Microsoft 365 tenants or manage Entra ID; the checks above belong to your IT team, your MSP or your incident responders. Our part is the data that has already left, and the exposure attackers start from.

• EDG3 is WebThreat's threat intelligence for leaked data. It watches the places where stolen company data is posted and sold: dark web forums and marketplaces, Telegram and other channels, and leak databases. For a domain you have authorized, it shows what has been posted about your company, where and by whom, and links reposted copies of a leak back to its first post. An EDG3 briefing with a threat intelligence analyst walks through what is out there for your domain, with every finding tied to its source.
• CEM looks at your leadership team. It finds the executives from your company name, checks their current and past email addresses against breach corpora and leak databases, and ranks the findings by what to fix first. Those are the addresses a password spray or a fraud attempt starts with. The methodology explains how the findings are ranked.
• Information Removal takes executives' personal data out of public view: our specialists file the opt-outs and takedown requests, verify each removal and re-check every 30 days, for families too on request.

If your tenant had a ConnectWise or SkyKick app and you want to know what about your company is already circulating, from this campaign or from earlier leaks, book an EDG3 briefing or contact us.

This article reflects the advisories and reports linked above as of 25 October 2026, 14:00 UTC. ConnectWise updates its advisory daily; its page and Microsoft's blog are the authority for current indicators and restoration steps.