Skip to content
All posts

· by NetProtector Security Team

ConnectWise Supply Chain Attack: 2,250 Microsoft 365 Tenants Targeted

Illustration: A broken link in the supply chain leads to numerous cloud tenants, several of them compromised

Attackers stole credentials for ConnectWise cloud services and used them to attempt to break into more than 2,250 Microsoft 365 customer environments. Microsoft attributes the campaign to the China-aligned group Storm-0940 – and reports that the attackers used an AI-powered tool. The case shows how dangerous trusted third-party apps in your own cloud can be.

What happened

Among other things, ConnectWise offers Cloud Backup (formerly SkyKick) for Microsoft 365 – primarily through IT service providers (MSPs). For such services to work, customers grant them extensive permissions in their Microsoft 365 tenant.

  • October 10–14, 2026: Storm-0940 first attempted to sign in to 327 accounts across eight organizations via password spraying – according to Microsoft, without success.
  • Afterwards: The attackers used stolen credentials of application identities belonging to the ConnectWise services. Because these apps already had permissions in the customer tenants, no user sign-in and no MFA prompt were required.
  • October 17–19: ConnectWise disabled the affected application identities and temporarily shut down Cloud Backup, SaaS Security and Cloud Management.
  • October 21: Microsoft published its analysis.

According to Microsoft, the sign-in attempts at times reached up to 2,900 attempts per minute. Via Microsoft Graph, the attackers performed reconnaissance, modified application credentials and attempted to escalate permissions – changes that can preserve access even after the original credentials have been revoked. In some cases, less than three hours passed between target selection and privileged access.

How many tenants were actually compromised has not been conclusively determined. Microsoft speaks of "numerous" organizations with persistent privileged access; reports cite around 160 confirmed unauthorized sign-ins. Whether data was exfiltrated often cannot be determined with certainty, because read access by an app via Graph is not logged in every case.

AI on the attacker's side

According to Microsoft, Storm-0940 used ARTEX, a freely available penetration testing framework that uses AI agents to automate reconnaissance, vulnerability discovery and credential attacks. What is new is less the technique than the speed: what used to take days of manual work, agents complete in hours – and against thousands of targets in parallel.

What you should do now

  1. Determine your ConnectWise exposure. Do you (or your IT service provider) use ConnectWise Cloud Backup, SaaS Security or Cloud Management? Keep affected connections disabled until ConnectWise provides guidance on restoration.
  2. Preserve logs before changing anything – otherwise traces will be lost.
  3. Review service principal sign-ins, not just user sign-ins – at least from October 1, 2026, if your retention allows. Look for new client secrets or certificates on apps and for new permissions.
  4. Clean up enterprise applications. Which third-party apps have which permissions in your tenant? Remove what is no longer needed and reduce permissions to the minimum necessary.
  5. Use Conditional Access for workload identities as well where available – for example, to restrict apps to known IP ranges.

Our assessment

Supply chain attacks strike where trust is greatest. A backup app needs read access to everything – which is precisely what makes it valuable to attackers. The principle of least privilege therefore applies to service providers too, and unusual behavior by a known app must stand out just as much as that of an unknown user. Anomaly detection here means: knowing what is normal and spotting deviations immediately.

Sources