Microsoft says a group it tracks as Storm-0940 used the AI-assisted penetration-testing framework ARTEX in a campaign that reached ConnectWise Cloud Backup customers' Microsoft 365 tenants. Its 21 October investigation describes activity dating back to September, including attempts to sign in to more than 2,250 tenants after ConnectWise application credentials were compromised. The figure counts tenants reached by sign-in attempts, not tenants whose data was taken.

The big change

  • What changed: A credential held by one software provider became a way to authenticate across customer tenants that had already trusted its applications. Microsoft says ARTEX accelerated the campaign's reconnaissance and use of those permissions.
  • Why it matters: A customer can disable the original vendor connection yet still have unauthorized credentials or role changes inside its tenant. That makes the local audit trail and application permissions as important as the provider's credential reset.
  • What to watch: ConnectWise is testing its restored environment before returning service in phases. Its instructions for reconnecting affected applications and each tenant's review of sign-ins, Graph activity and changed credentials will determine what customers can safely re-enable and what they can establish about access.

How the provider credential crossed into customer tenants

ConnectWise Cloud Backup, formerly SkyKick, operates as a multi-tenant application. A customer grants the application permissions so it can back up Microsoft 365 data. The application's credential is held by the provider; with that credential, an actor can request app-only access tokens in customer tenants that have consented to the application, without a person's password or a user sign-in. Sophos X-Ops observed this pattern in a roughly 96-minute sweep on 15 October. Sophos said the source of the stolen credential and the eventual use of the issued tokens were unknown in the tenants it examined.

ConnectWise says it identified unauthorized access to Cloud Backup application credentials. On 17 October it disabled seven related application identities and revoked certificates used for affected connections. Those steps prevent new authentication through the disabled connections; ConnectWise cautions that they do not undo changes already made in a tenant or remove separate access an attacker may have established. The company also suspended Cloud Backup, SaaS Security and Cloud Management while it investigated and prepared a phased restoration.

Microsoft attributes the broader campaign and the ConnectWise compromise to Storm-0940, which it assesses is aligned with China. It says the group used ARTEX as early as September against hundreds of organizations across several industries. During the ConnectWise incident, Microsoft says the framework accelerated scanning, reconnaissance, password spraying and abuse of OAuth application access. That is an account of ARTEX's role in specific observed activity, not evidence that an AI system independently chose every target or carried out every stage of the intrusion.

The reported numbers describe different parts of the operation. Microsoft recorded more than 151,000 failed logons against 327 accounts at eight organizations during a 10–14 October password spray, with no successful authentication observed in that phase. Its more than 2,250-tenant figure concerns later sign-in attempts using the ConnectWise application identities. Microsoft says most targeting failed, but several ARTEX-assisted attacks obtained privileged cloud access, in multiple cases less than three hours after initial targeting. It has not published a count of tenants whose data was accessed or stolen.

Huntress's 19 October update said it did not then believe the failed password-spray attempts were related to the application sign-ins it investigated. Microsoft's 21 October report places both in its broader Storm-0940 account. Huntress's tenant findings therefore corroborate application abuse and persistence, but do not independently establish Microsoft's wider campaign linkage.

Authentication, persistence and data access are separate findings

Microsoft observed follow-on Graph and directory activity in multiple customer environments, including reconnaissance, changes to application credentials and attempts to change privileged roles. Huntress's investigation independently documents two tenants where an application assigned itself Global Administrator and added secrets to other applications. Huntress also found almost 1,000 Entra tenants with sign-in activity from an address associated with the unauthorized activity, with more than 300 successful sign-ins. Those are Huntress's observations of that address, not a replacement count for Microsoft's broader set of attempted tenant sign-ins.

A successful app sign-in proves the credential worked for that tenant. A role assignment or newly planted secret shows a further change that can preserve access beyond the provider's original connection. Neither finding by itself proves that mail, files or other customer data were read or exported. Microsoft's detection account also describes secret reads across multiple Azure Key Vaults, a narrower observed data-access finding without a published count of affected customers. Huntress found no evidence of mailbox or file manipulation in the two tenants it examined, while warning that some Microsoft Graph reads leave no audit record. Microsoft likewise says even a successful authentication does not necessarily mean customer data was accessed or exfiltrated.

ConnectWise's 23 October 14:00 UTC advisory update says existing backup archives remain encrypted and isolated, with no indication they were compromised. That finding concerns stored backup archives; ConnectWise says individual live Microsoft 365 environments still need review. As of that update, it told partners to keep affected connections disabled pending service-specific reconnection instructions.

For organizations using ConnectWise directly or through a managed provider, the immediate question is which applications were authorized in each tenant, whether they signed in, and what changed afterward. Microsoft recommends preserving service-principal sign-in and audit records, reviewing successful and failed sign-ins separately, and checking Graph activity, application credentials and role assignments. It advises against deleting enterprise applications as the first response because their configuration and evidence matter to the investigation. ConnectWise's technical investigation guide covers both a provider's own tenant and managed customer tenants, including legacy SkyKick connections.

The ARTEX name has appeared in a separate BIG CHANGE report on GMO Cybersecurity's investigation of attacks targeting Japanese firms. The shared tool does not establish that the same actor ran those attacks and this ConnectWise campaign.

Sources & further reading