ConnectWise Breach: 2,250 M365 Tenants Targeted [2026]

Microsoft has attributed attempted cloud sign-ins against more than 2,250 Microsoft 365 tenants to Storm-0940, a China state-aligned threat actor, tracing the campaign to a compromised ConnectWise Cloud Backup service (formerly SkyKick). The group used ARTEX, an open-source Go-based agentic AI penetration-testing framework, for scanning, password spraying and OAuth application abuse, with vendor-identity sign-ins beginning October 15, 2026 and peaking at about 2,900 to 3,000 attempts per minute. A separate password spray hit 327 accounts across eight organizations with more than 151,000 failed logons and no successful logons, and ConnectWise suspended Cloud Backup, SaaS Security and other services.

Microsoft has tied a burst of cloud sign-in attempts against more than 2,250 Microsoft 365 tenants https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687 to Storm-0940, a China state-aligned threat actor, and the trail runs through a compromised ConnectWise Cloud Backup service. The group used ARTEX, an open-source, Go-based agentic AI penetration-testing framework, to automate scanning, password spraying and OAuth application abuse. Defenders now have a live case study of what an AI agent does when a trusted vendor identity hands it the keys. The scale is the headline, but the wording matters. TechCrunch framed the story as Chinese hackers spying on thousands of companies. The confirmed figure is narrower and still serious: more than 2,250 tenants faced attempted sign-ins, which is not the same as 2,250 confirmed breaches. This analysis separates what Microsoft and ConnectWise have said from what remains unexplained, then looks at what the campaign means for managed service providers, backup vendors and the security teams that depend on them. Readers who followed our report on the BeyondTrust zero-day and the China-linked APT behind it https://shattered.io/beyondtrust-cve-2026-102764-china-apt-zero-day-2026/ will recognize the shape of this story. Attackers keep aiming at the administrative plumbing that sits between a vendor and its customers, because one stolen credential there reaches far more targets than one phished employee. Don't miss new tech stories on Google Add Shattered once in the Google app and our stories show up in your news suggestions. Add now https://www.google.com/preferences/source?hl=en&q=https%3A%2F%2Fshattered.io%2F What Microsoft Attributed to Storm-0940 Microsoft attributed the activity to Storm-0940, which it describes as a China state-aligned actor. The company said the group used ARTEX for scanning and reconnaissance, password spraying and abuse of OAuth applications. Microsoft-linked reporting dates the ARTEX activity to September 2026, and the ConnectWise-specific phase began in mid-October. On October 15, 2026, the attackers began using identities associated with multiple ConnectWise cloud applications to authenticate to customer environments. That detail explains why the campaign looked so different from a normal spray. The sign-in attempts arrived carrying the identity of a vendor that customers had already authorized to touch their tenants. The Hacker News described the operation https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html as ARTEX-driven AI agents running inside a ConnectWise supply chain attack https://shattered.io/category/security/ . CSO Online ran a similar framing, stressing that the actor used agentic AI against the 2,250-tenant pool. Both outlets rely on Microsoft’s own findings, and neither reported a named executive or analyst speaking on the record in the coverage reviewed for this piece. The Confirmed Facts at a Glance Before the analysis, here is the record as it stands on October 24, 2026. Each row reflects the facts Microsoft and ConnectWise have put on the table, plus the gaps nobody has filled. | Item | What is confirmed | Status | |---|---|---| | Attributed actor | Storm-0940, China state-aligned per Microsoft | Confirmed by Microsoft | | Compromised service | ConnectWise Cloud Backup, formerly SkyKick | Confirmed | | Tooling | ARTEX, open-source, Go-based agentic AI pentest framework | Confirmed | | Tenants targeted | More than 2,250 Microsoft 365 tenants, attempted sign-ins | Confirmed as attempts | | Peak speed | About 2,900 to 3,000 sign-in attempts per minute | Confirmed | | Vendor identity abuse begins | October 15, 2026 | Confirmed | | Separate password spray | 327 accounts, eight organizations, more than 151,000 failed logons, no successful logons | Confirmed | | Services suspended | Cloud Backup, SaaS Security, Cloud Management | Confirmed, phased restoration under way | | Partner backup data | No indicators of compromise at time of cited reporting | Could change | | How the credential was stolen | Not publicly explained | Unconfirmed | How the ConnectWise Cloud Backup Breach Worked The attackers obtained ConnectWise application credentials and used them to authenticate to customer environments. Cloud Backup, the service formerly sold as SkyKick, plugs into Microsoft 365 tenants so it can copy mailboxes, files and other data. To do that job, it holds permissions that most employees will never have. Whoever controls its application identity inherits a slice of that trust. Cybersecurity Dive tied the China-nexus actor https://www.cybersecuritydive.com/news/china-nexus-actor-attack-connectwise-cloud-backup/833727/ to the attack on Cloud Backup, which matches Microsoft’s account. The mechanics then follow a familiar path. A stolen application identity looks legitimate to the tenant, so sign-in logs show a known vendor app rather than a stranger from an odd country. Defenders who tuned alerts around human behavior can miss it. Why application identities are the soft spot Service principals and OAuth apps rarely face the same controls as people. They skip interactive MFA prompts, they often hold broad delegated or application permissions, and their secrets can live for months or years. Security teams review user accounts every quarter, yet many never audit which third-party apps hold consent in their tenant. Storm-0940 aimed straight at that gap. What nobody has explained yet The cited reporting does not say how the attackers first stole the ConnectWise application credential. That omission matters. Until ConnectWise or Microsoft names the entry point, other vendors cannot tell whether they share the same weakness, whether the cause was a build secret, a phished engineer, a misconfigured store or something else. Treat any confident claim about the initial vector as speculation. Inside ARTEX: The Agentic AI Pentest Framework ARTEX is an open-source penetration-testing framework written in Go. As an agentic AI tool, it can chain tasks that a human red-teamer would normally run by hand: find targets, probe them, try credentials, and follow up on what opens. Microsoft said Storm-0940 pointed it at scanning and reconnaissance, password spraying and OAuth application abuse. That is a dual-use story, and it is an old one. Cobalt Strike began as a legitimate red-team product and ended up in countless ransomware playbooks. ARTEX looks set to follow the same arc, with one difference. An agentic tool does not just run commands faster. It chooses what to try next, which can compress the gap between a stolen secret and a working foothold. Banks are already reacting to the same pressure from the other side. Our look at five US banks that block third-party AI agents from customer accounts https://shattered.io/us-banks-block-third-party-ai-agents-customer-accounts-2026/ shows institutions drawing a hard line around automated actors. The ConnectWise case gives their caution a concrete example, because an AI agent holding a trusted identity behaves like a customer, a vendor or an attacker depending on whose hands it sits in. Open-source release also changes the defender math. Anyone can download ARTEX, read the code and study its traffic patterns, which helps blue teams write detections. It also means that lower-skill crews can borrow capabilities that once belonged to well-funded state groups. Expect copycat tooling. 2,250 Tenants and 3,000 Sign-Ins a Minute: Reading the Numbers The figure of more than 2,250 Microsoft 365 tenants describes attempted sign-ins. It does not describe confirmed compromises, and Microsoft’s public framing does not claim that every tenant fell. A sign-in attempt can fail on a wrong secret, a conditional access block, a disabled app or a missing consent grant. The speed is the second number worth studying. At roughly 2,900 to 3,000 attempts per minute, the activity ran fast enough to look like infrastructure rather than a person. A human operator working a keyboard cannot do that. An agentic framework iterating across a tenant list can, and it can keep going while analysts sleep. Rate alone is a weak signal, though. A busy enterprise can generate thousands of legitimate sign-ins per minute across its user base. What stands out here is the concentration: one family of vendor identities, many unrelated tenants, one short window. A cross-tenant view like that is hard for any single customer to build, which is why vendor-side telemetry matters. TechCrunch ran the story under a headline that said Chinese hackers spied on thousands of companies after breaching ConnectWise. Our fact sheet does not support “spied on” as a blanket claim, so this article sticks to the narrower language Microsoft used. The 327-Account Password Spray A separate password-spraying campaign gives the clearest picture of the attackers’ working method. It targeted 327 accounts across eight organizations and produced more than 151,000 failed logons. No successful logons came out of that campaign. Do the arithmetic and the pattern emerges. Spread across 327 accounts, 151,000 failures works out to roughly 460 failed attempts per account. That is a heavy, patient grind against a small target set, not the thin one-password-per-user spray that evades lockouts. The attackers appear to have chosen volume over stealth in that campaign, and the defenders held. The lesson cuts two ways. A zero-success result shows that basic hygiene works: lockout thresholds, strong passwords and phishing-resistant MFA stopped a high-volume AI-assisted spray. Yet it also shows the attackers can afford failure. When an agent costs almost nothing to run, a campaign that fails against eight organizations still pays off if the next ConnectWise-linked attempt lands. ConnectWise Response: Three Services Suspended ConnectWise suspended Cloud Backup, SaaS Security and Cloud Management as a precaution, then began a phased restoration of the affected services. The company said that, at the time of the cited reporting, it had no indicators that partner backup data had been compromised. Pulling three services at once is a costly choice. Managed service providers lean on these products for daily backup jobs and security monitoring, so every hour offline leaves their customers with a gap in coverage. ConnectWise accepted that pain to cut off the stolen identities. Most security professionals would call that the right trade, though it leaves partners scrambling to prove their own backups ran. The phrase “no indicators” deserves careful reading. It states what ConnectWise had found at one point in time. It does not promise that the data is safe. Forensic work on cloud identity abuse often takes weeks, and the absence of evidence in week one rarely closes a case. Why “Thousands of Companies Breached” Overstates the Record Headlines compress. When a story involves 2,250 tenants and a state-aligned actor, “breached thousands of companies” is the version that travels. The facts do not back it. Microsoft’s number counts attempted sign-ins against tenants. Some attempts probably failed, and public reporting has not said how many succeeded. Precision matters for practical reasons. A security lead who reads that thousands of firms fell may panic or may tune out as hype. One who reads that more than 2,250 tenants were targeted through vendor identities knows what to do: check whether the vendor is installed, review its consent and read the sign-in logs. The accurate version produces better action. The same discipline applies to attribution. Microsoft assigns the activity to Storm-0940 and calls the actor China state-aligned. That is Microsoft’s assessment, and this article attributes it to Microsoft rather than presenting it as a court finding or a government statement. Supply-Chain Lessons From SolarWinds and Kaseya Security teams have watched trusted vendors become attack paths before. The SolarWinds compromise of 2020 used a poisoned software update to reach customer networks. The 2021 Kaseya VSA incident abused remote-management software to push ransomware downstream. Each event taught the industry that a vendor’s access is an attacker’s access once the vendor falls. The ConnectWise case adds a twist. The attackers did not need to ship malicious code to customers. They needed application credentials and a way to automate what came next. The table below compares the three patterns at a high level. | Incident | Year | Path to customers | Automation angle | |---|---|---|---| | SolarWinds | 2020 | Trojanized software update | Manual follow-on operations | | Kaseya VSA | 2021 | Remote-management software pushed ransomware | Scripted mass deployment | | ConnectWise Cloud Backup | 2026 | Stolen cloud application credentials | Agentic AI framework ARTEX drove scanning, spraying and OAuth abuse | The pattern shows a steady shift from code tampering toward identity abuse. Patching an agent does nothing against a stolen secret. Third-party risk is also broader than most programs assume: our coverage of the Kroll finding that tech firms make up 79% of third-party breach victims https://shattered.io/tech-firms-79-percent-third-party-breach-victims-kroll-2026/ shows how often the weak link sits one contract away. What Industry Research Says About AI-Speed Attacks Analysts had warned that this moment was coming. In a March 2025 press release, Gartner stated: “By 2027, AI agents will reduce the time it takes to exploit account exposures by 50%.” The Gartner release https://www.gartner.com/en/newsroom/press-releases/2025-03-18-gartner-predicts-ai-agents-will-reduce-the-time-it-takes-to-exploit-account-exposures-by-50-percent-by-2027 framed the forecast around account exposures, which is exactly the class of weakness that a stolen ConnectWise application identity represents. Gartner also looked at the defender’s side. In its 2025 Emerging Tech Impact Radar on the AI cybersecurity ecosystem, hosted by Palo Alto Networks, the firm said: “Through 2029, more than 50% of successful cybersecurity attacks against AI agents will exploit access-control issues, using direct or indirect prompt injection as an attack vector.” https://www.paloaltonetworks.com.au/resources/research/gartner-emerging-tech-impact-radar-ai-cybersecurity-ecosystem That forecast targets attacks on AI agents rather than attacks by them, but the lesson carries over. Access control is the pressure point on both sides. The same report offered a third data point on readiness: “By 2030, more than 60% of enterprises will secure the AI life cycle and various AI implementations within an AI security platform, up from less than 10% in 2025.” Gartner wrote that line as a forecast, not a measurement of today’s state. It does suggest that most organizations start this race with little dedicated tooling. Neither forecast mentions ConnectWise, and Gartner did not comment on this incident in anything we reviewed. Read them as context, not as verdicts on Storm-0940. They show that the scenario Microsoft described fits what researchers expected for the middle of the decade. Market Impact: MSPs, Backup Vendors and Insurers The immediate hit lands on managed service providers. Many MSPs resell ConnectWise products and promise customers continuous backup and security monitoring. A suspension of three services forces them to explain to clients why the safety net went offline, and to document what ran and what did not. Backup and SaaS-management competitors stand to gain attention, though not automatically customers. Buyers will ask every vendor in the category the same questions. How are application secrets stored? How often do they rotate? Can a customer scope permissions narrowly? Vendors that answer clearly can turn the incident into a sales argument. Vendors that dodge will lose deals. Insurers face a harder question. A single compromised vendor identity touching many tenants is the kind of correlated event that cyber underwriters dislike. We have no verified figures on claims or premium changes tied to this incident, so we will not guess at them. The direction of travel is clear enough: expect tougher questionnaires about third-party app consent and credential rotation at the next renewal cycle. Microsoft’s own position is double-edged. It published the attribution, which supports the case for its security stack. Yet the targets were Microsoft 365 tenants, and the weak point lived in how third-party apps hold consent. For more on how the broader market for detection tools shakes out, see our SIEM comparison of Sentinel, Splunk, Elastic and Wazuh https://shattered.io/siem-tools-compared-sentinel-splunk-elastic-wazuh-2026/ . What Defenders Should Do This Week If your organization or your MSP uses ConnectWise Cloud Backup, SaaS Security or Cloud Management, start with the vendor’s own advisories and Microsoft’s guidance. The steps below follow standard identity-incident practice and rest on the facts above. | Priority | Action | Why it matters | |---|---|---| | 1 | Inventory ConnectWise and SkyKick app registrations in Entra ID | The attackers authenticated using ConnectWise cloud application identities | | 2 | Review and rotate secrets, tokens and consent for those apps | Stolen credentials stay valid until someone revokes them | | 3 | Preserve sign-in, audit and OAuth logs before making changes | You need evidence if the attempts succeeded | | 4 | Hunt for bursts of failed sign-ins near 2,900 to 3,000 per minute | That rate marked the reported ARTEX activity | | 5 | Require phishing-resistant MFA for privileged users | The 151,000-failure spray produced no successful logons | | 6 | Confirm backup jobs ran during the suspension window | Services were offline while ConnectWise restored them in phases | A starter hunting query The Kusto query below, written for Microsoft Sentinel or Log Analytics, flags source addresses that generate heavy failure bursts. Tune the threshold to your own baseline, since a large tenant will see far more traffic than a small one. SigninLogs | where TimeGenerated ago 14d | where ResultType = 0 | summarize Failures = count , Accounts = dcount UserPrincipalName by IPAddress, bin TimeGenerated, 1m | where Failures 100 | order by Failures desc To list candidate vendor apps through Microsoft Graph PowerShell, run the following and adjust the name match to whatever your tenant displays. Connect-MgGraph -Scopes "Application.Read.All" Get-MgServicePrincipal -All | Where-Object { $ .DisplayName -match "ConnectWise|SkyKick" } | Select-Object DisplayName, AppId, Id Passwords alone will not carry the load. If your sign-in story still leans on shared secrets, our walkthrough on how to create a passkey login with WebAuthn https://shattered.io/how-to-create-a-passkey-webauthn-login-2026/ shows the phishing-resistant path in practice. For broader coverage of attacks, breaches and defenses, browse the security section https://shattered.io/security/ . Governing AI Agents on Both Sides of the Fence The incident also exposes a policy gap. Security teams are rushing to deploy their own AI agents for triage, patching and response. Each one needs an identity, a set of permissions and a way to be shut off. If defenders hand those agents the same loose, long-lived secrets that Storm-0940 exploited at ConnectWise, they build the next target themselves. Vendors are starting to ship guardrails. Our piece on the NVIDIA OpenShell reference architecture for agent safety https://shattered.io/nvidia-openshell-reference-architecture-agent-safety-2026/ describes one approach that pins agents to constrained layers. None of these designs would have stopped a stolen ConnectWise credential, but they point at the principle that matters: short-lived, scoped, auditable identity for every non-human actor. Five Predictions for the Next 90 Days These are our editorial expectations, not reported facts. Treat them as informed judgment and check them against the record as it develops. - More vendor disclosures. Other backup and SaaS-management providers will audit their own application identities, and at least some will publish findings or credential resets. - A named entry point. ConnectWise or Microsoft will likely explain how the application credential was stolen as the investigation matures, because partners and insurers will demand it. - Tighter app-consent defaults. Expect Microsoft and its partners to push stricter controls on third-party OAuth consent and on long-lived service-principal secrets. - Copycat AI tooling. Because ARTEX is open source, other crews will adapt it or build lookalikes, and defenders will see agent-driven spraying outside state campaigns. - Contract changes. MSP agreements and cyber-insurance questionnaires will add clauses on credential rotation, app-consent audits and breach notification timelines for vendors. The takeaway: this case is less about one vendor than about a habit. Organizations grant third-party apps wide access, forget the grants exist, and discover them only when an attacker uses one. AI agents make that habit more expensive every month. Frequently Asked Questions Who is behind the ConnectWise Cloud Backup attack? Microsoft attributed the activity to Storm-0940, a China state-aligned threat actor. That is Microsoft’s assessment, and no court or government finding is part of the cited reporting. What is ARTEX? ARTEX is an open-source, Go-based, agentic AI penetration-testing framework. Microsoft said Storm-0940 used it for scanning and reconnaissance, password spraying and OAuth application abuse. Were 2,250 companies actually breached? No, not as a confirmed figure. Microsoft reported attempted sign-ins against more than 2,250 Microsoft 365 tenants. Public reporting has not said how many of those attempts succeeded. Which ConnectWise services were affected? The compromise involved ConnectWise Cloud Backup, formerly known as SkyKick. As a precaution, ConnectWise suspended Cloud Backup, SaaS Security and Cloud Management, then began restoring them in phases. Was partner backup data stolen? ConnectWise said it had no indicators, at the time of the cited reporting, that partner backup data had been compromised. That statement reflects a point in time and may change as the investigation continues. How did the attackers get the ConnectWise credentials? The cited reporting does not explain it. The initial method of theft remains unconfirmed. What was the password-spraying campaign? A separate campaign targeted 327 accounts across eight organizations and produced more than 151,000 failed logons. It produced no reported successful logons. What should an IT team do first? Inventory ConnectWise and SkyKick application registrations in your tenant, rotate their secrets and review consent, preserve logs before changing anything, and follow the guidance ConnectWise and Microsoft have published.