Microsoft says a China-linked hacking group used a stolen ConnectWise credential and an open-source AI hacking framework to try to sign into more than 2,250 Microsoft 365 tenants. The attribution, published October 21, is the first public naming of a suspect in the ConnectWise Cloud Backup breach, which ConnectWise disclosed around October 16. Most of the sign-in attempts failed, Microsoft said, but the campaign shows how a trusted vendor app can become the way in.
For IT teams, the lesson sits in the access model more than in the leaked secret. The main intrusion worked through an application that customers had already approved, not through a user's password.
ConnectWise Cloud Backup breach: what happened
Microsoft Threat Intelligence attributes the activity to Storm-0940, a China-linked group that has been active since at least 2021. According to The Register's report on Microsoft's findings, the group used ARTEX, an open-source AI penetration-testing framework, to automate attacks on Microsoft 365 environments. The Next Web described the same findings as showing China-aligned hackers using AI agents in the ConnectWise attack.
The campaign did not start with ConnectWise. Between October 10 and 14, the group ran a password-spraying phase that produced more than 151,000 failed sign-in attempts against 327 accounts at eight organizations, according to a Daily.dev summary of Microsoft's findings. Only then did the group pivot to stolen ConnectWise credentials. Storm-0940 has long relied on password spraying and on exploiting internet-facing applications, so the early phase fits a playbook the group already used.
The key dates, as reported across the coverage, run in this order:
- October 10 to 14: Password spraying against 327 accounts at eight organizations, with more than 151,000 failed sign-in attempts.
- October 16: ConnectWise discloses the incident, and Huntress confirms unauthorized access at 162 tenants.
- October 17 at 07:00 UTC: ConnectWise disables seven application identities and suspends Cloud Backup by revoking certificates.
- October 21: Microsoft Threat Intelligence publishes its attribution to Storm-0940.
For a separate Microsoft 365 intrusion that also avoided passwords, read USA 24's report on stolen tokens.
How Storm-0940 used ARTEX and a trusted OAuth app
The core of the intrusion was an OAuth application called ConnectWise Cloud Backup, formerly known as SkyKick. Customers grant apps like this permissions inside their Microsoft 365 tenants so the software can do its job. The app is multi-tenant, so a stolen credential for it can request access tokens in every tenant where the app is installed.
Microsoft Threat Intelligence researchers said the activity "likely abused permissions previously granted by customers," as Cybersecurity Dive reported. That phrasing matters. The attackers did not need to break a flaw in Microsoft's software, because they used access that customers had already handed over. Microsoft says the activity did not come from a vulnerability in its own products.
The AI element comes from ARTEX. According to Microsoft, the group used it to automate reconnaissance, password spraying and OAuth abuse at machine speed. The sign-in attempts reached more than 2,250 tenants at up to 2,900 attempts per minute, and in some cases the group reached privileged cloud access in under three hours.
Password spraying and abused permissions are both old techniques. What changes is throughput. Automation lets one crew test thousands of tenants in the time a manual operator would spend on a handful, which shrinks the window defenders have to spot a pattern.
How many Microsoft 365 tenants were affected
The 2,250 figure is the headline, but it counts sign-in attempts against tenants, not confirmed breaches. One analysis of Microsoft's findings makes the same distinction and describes the number as a count of targets. Keep that in mind whenever a figure like this turns into a headline.
Confirmed compromise numbers have arrived in pieces. Huntress confirmed unauthorized access at 162 tenants as of October 16. The Hacker News later reported 173 tenants in its coverage of the compromised credential. Those counts come from different dates and sources, so treat them as snapshots rather than a settled total.
Huntress also identified nearly 1,000 tenants that received sign-in attempts, with more than 300 showing successful attempts, according to The Next Web's report. Those figures sit awkwardly beside Microsoft's statement that most attempts failed. The sources do not reconcile them, and that gap is one of the central open questions in this case.
Microsoft has not said how many organizations were compromised or whether data was stolen. For most businesses, the practical question is narrower: was the ConnectWise app enabled in your tenant? Todyl advised customers to presume compromise in any tenant where the app was enabled, as Dark Reading reported.
What attackers could do inside a compromised tenant
Todyl found that attackers could read and write mail and files in affected tenants. They could also keep access by elevating privileges and adding credentials to other applications. The Next Web reported that attackers added new authentication keys and changed administrator roles to keep their foothold.
Those mechanics shape the cleanup. ConnectWise says the affected shared Cloud Backup credentials are no longer valid, but previously issued access tokens may remain usable until they expire. An admin who only rotates the app's secret can leave an active token in place. ConnectWise also says it has no evidence that Cloud Backup partner backup data was compromised, a claim that is narrower than the access problem inside customer tenants.
Third-party exposure has been a recurring 2026 story. USA 24 reported on PwC's confirmation of a vendor breach, another example of how a supplier's compromise can spill into the businesses that rely on it.
What US businesses and MSPs should do now
Any US business, managed service provider or school that consented to ConnectWise Cloud Backup in Microsoft 365 should start a review today. Dark Reading's coverage flagged particular concern for downstream MSPs, because one compromised vendor can touch many client tenants. Work through these steps:
- Find the app. Search your enterprise applications and consent grants for ConnectWise Cloud Backup, including older tenants that may still show the SkyKick name. Match against app ID 506e08f9-6e9a-4da4-942b-a099a03644ae.
- Preserve sign-in and audit logs before you change anything, so you can reconstruct what happened.
- Review service principal sign-ins from unrecognized IP addresses, along with app credential changes and OAuth grant activity tied to that app ID.
- Hunt for new credentials added to other applications and for recent changes to administrator roles, both of which attackers reportedly used to keep access.
- Revoke the app's permissions and active sessions, and assume tokens issued before revocation may still work until they expire.
- Check every Microsoft 365 tenant that may have connected to ConnectWise, including client tenants if you run an MSP.
- Map which third-party apps connect to your tenant and write down how to cut each one off quickly.
If you use ConnectWise management apps for Teams, Exchange or SharePoint, review them too. Whether those were abused remains under investigation, and a quiet answer now is not the same as a clean one.
Open questions and what to watch next
Several basics remain unresolved. ConnectWise has not publicly attributed the breach, so the exact way the credential leaked is still unknown. ConnectWise says it cannot see customer environments, which means it cannot determine on its own which tenants were affected. The restoration timeline for Cloud Backup is not confirmed in the reporting.
Watch whether ConnectWise explains how the credential leaked and when Cloud Backup returns. Watch whether Huntress's count of more than 300 successful attempts becomes confirmed compromise, and whether Microsoft updates its numbers or says whether data was taken. The case also raises a question for every vendor that holds broad permissions in customer tenants: how many clients could one stolen secret reach, and how long would it take them to find out.
