Summary 

• Attackers signed in to Microsoft 365 as a trusted backup app, so they needed no user password and MFA never applied. 
• Microsoft has linked the attack to a China-state-aligned group using AI agents, which in some cases reached high-level access in under three hours.
• Any business with ConnectWise Cloud Backup (formerly SkyKick) connected to its Microsoft 365 should check its account, even if the connection is no longer in use.
• The wider lesson is that every app with access to your systems is a possible way in, so it is worth knowing which apps have access and what they can do.

In the ConnectWise breach, which began around 15th October 2026, attackers used stolen credentials for ConnectWise Cloud Backup to sign in to customers’ Microsoft 365 accounts. ConnectWise is a software company whose products are mainly used by IT providers, and its Cloud Backup tool, formerly SkyKick, backs up email, files and other data in Microsoft 365. On 21 October, Microsoft linked the attack to Storm-0940, a group it describes as China-state aligned, which used AI agents to do much of the work.

The access the attackers used was access businesses had already granted to a tool they trusted, so nothing looked out of place. How quickly that kind of misuse is spotted decides how much damage it does.

If you or your IT provider ever connected ConnectWise Cloud Backup to your Microsoft 365, it is worth checking your account now, even if the connection is no longer in use.

What Happened in the ConnectWise SkyKick Breach?

Attackers got hold of the credentials ConnectWise Cloud Backup uses to reach its customers’ Microsoft 365 and Microsoft said they “likely abused permissions previously granted by customers to the application”, according to The Record. The backup tool needs wide access so it can copy data such as email and files, and it gets that access through several app identities, which work like logins for software and sign in by themselves. ConnectWise held these credentials and used the same ones to reach different businesses’ accounts, so attackers who had them could try many accounts at once.

Microsoft says the attackers tried to get into more than 2,250 Microsoft 365 tenants. Most attempts failed, but at many organisations they gained what Microsoft calls “privileged cloud persistence”, meaning high-level access that can survive a clean-up. In some accounts, they gave themselves admin rights and added their own credentials so they could get back in later.

ConnectWise suspended Cloud Backup on 17 October, and soon after took its SaaS Security and Cloud Management services offline as a precaution. Its CEO, Manny Rivelo, said the company had “contained the affected application connections” and was restoring services in controlled phases, according to Reuters. On 28 October, its status page announced that Microsoft 365 backups and restores were coming back through a new, security-hardened app, with other features returning over the following days.

The table below sets out how the attack unfolded.

Who Is Affected by the ConnectWise Breach?

The businesses most at risk are those with ConnectWise Cloud Backup connected to their Microsoft 365, including old connections that are no longer used. Microsoft advises reviewing every account where the apps were ever installed or approved.

ConnectWise says it has no evidence that its stored backup archives were accessed, but its status page says Cloud Backup gives it no visibility into partner and customer environments, so it cannot tell whether a specific customer’s Microsoft 365 was affected. That leaves each business, or its IT provider, to check for itself.

Microsoft says Storm-0940’s wider campaign targeted organisations in sectors including aerospace and defence, financial services, government, legal, manufacturing and technology. Microsoft is careful to point out that an attacker signing in does not always mean data was taken, and investigations are still going on.

How Did Attackers Get Into Microsoft 365 Without a Password? 

They signed in as the backup app itself, and Microsoft says its own systems were not hacked. When a business connects a tool such as a backup service to Microsoft 365, it approves the tool once, and from then on the tool signs in by itself using its own credentials, such as a certificate or secret.

These app sign-ins happen without a person logging in, so multi-factor authentication (MFA) never comes into play. BleepingComputer reported that the attacker’s sign-ins came from an automated script with no user login. To Microsoft 365, these sign-ins came from an app the business had already approved.

Switching off the app does not undo what an attacker has already done. According to Reuters, ConnectWise’s CEO said its actions “do not remove unauthorized access that may have already been established” in customer accounts. That means new admin rights or credentials stay in place until someone finds and removes them.

What Should Organisations Do After the ConnectWise Breach?

Microsoft and ConnectWise have published detailed guidance for IT and security teams. The steps are:

1. Find out whether the apps were ever connected. Ask your IT provider, or check the list of connected apps (called enterprise applications) in Microsoft Entra ID. Microsoft advises searching for each app by its ID number rather than its name. The app IDs Microsoft lists are:
   
   ConnectWise Cloud Backup: 506e08f9-6e9a-4da4-942b-a099a03644ae
   ConnectWise – MS Teams: 24205314-2b89-4e07-a2a4-579e898a5640
   ConnectWise – MS Graph: 0de14c77-b9b0-4137-9360-34878a929827
   
   For detailed steps, see Microsoft’s guidance for IT and security teams. 
   
   
2. Keep the old ConnectWise app connections switched off. ConnectWise has blocked new sign-ins on its side, but the apps still sit in each Microsoft 365 account and earlier access tokens may keep working until they expire, so Microsoft and ConnectWise both advise keeping them disabled. To restart backups, ConnectWise now asks partners to approve a new app, “ConnectWise Cloud Backup for M365”, for each Microsoft 365 account, so check with your IT provider that this has been done, and that important data is backed up another way until it has.

    

3. Save the evidence as you go. Keep sign-in and audit logs, and do not delete the apps as a first step, since their records help show what happened. Microsoft also says urgent containment should not wait for logs to be exported.

    

4. Review activity from early October onwards. Microsoft advises checking from at least 15 October, and app sign-ins back to 1 October where records exist. Look for new admin roles, new app credentials, changes to users or groups, unusual email or file access and new rules that automatically forward emails to an outside address.

    

5. Remove anything unauthorised and reset credentials. An authorised responder should remove confirmed unauthorised credentials, permissions and accounts, and replace any credentials that may have been exposed.

    

6. Check what every other app can access. Give each app only the permissions it needs and keep watching for apps that suddenly gain new rights.

How Was ARTEX AI Used in the ConnectWise Attack?

Microsoft says Storm-0940 used ARTEX, an open-source penetration testing framework that runs on AI agents. Security teams normally use tools like this, with permission, to test their own defences. Storm-0940 used it to attack instead, and the AI agents did much of the work themselves, from finding targets to misusing app permissions, with very little human input.

The speed stands out. Microsoft recorded over 200 sign-ins in under four minutes using four app credentials. Across the same campaign, including attacks that did not go through ConnectWise, it saw several cases where the group went from first targeting to privileged cloud access in under three hours.

When attackers can reach high-level access in under three hours, a response that takes a day or more gives them time to settle in. How quickly unusual activity is spotted and acted on matters as much as the defences in place.

Why the ConnectWise Attack Is a Supply Chain Risk for Every Business

Every app you connect to Microsoft 365 is given some level of access to your data. Backup, monitoring, remote access and security tools often need wide permissions to do their job, and the more of them a business connects, the more access there is to keep track of.

When the company behind one of those tools is compromised, every business connected to it can be exposed at once. In this case, a single backup service gave attackers a way to target more than 2,250 Microsoft 365 tenants, without the businesses themselves doing anything wrong.

The PHP2Shell vulnerabilities in October  taught a similar lesson. Risk often sits in the layers a business does not see day to day, and the gaps grow when responsibility for those layers is spread across several providers.

How ThreatSpike Handles an Incident Like This

For the businesses whose IT and security ThreatSpike manages, Microsoft 365 is part of the managed IT we run, so the apps connected to it are already part of the systems we look after. When a supplier is breached, the first thing a business wants to know is whether it is affected. For our customers, we would find that out for them by checking the environments the supplier could reach and containing anything suspicious, so they hear what happened and what was done without having to coordinate it. 

Our managed SOC watches endpoints, cloud, network, email and web apps 24/7. When it spots a threat, the platform responds automatically within 2 to 5 minutes, and an analyst then investigates. Forensics and root cause analysis are part of our unlimited incident response, with no call-out fees.

We worked the same way during PHP2Shell, when threat intelligence let our team identify affected customer systems and scope the fixes before patches were released. With one team managing and watching each environment, a suspicious change can be dealt with straight away, without a handover between providers. 

Suppliers will keep being targeted, so the parts you can control are how much each connected app can reach and how quickly misuse is spotted and shut down. Trust in a supplier should never be assumed, especially for apps that sign in to your systems every day without anyone watching. 

If you are not sure which apps can reach your Microsoft 365, or your IT and security sit with different providers, explore how ThreatSpike runs both on one platform.