Storm-0940 abuses ARTEX AI agents and stolen ConnectWise Cloud Backup (SkyKick) app credentials against 2,250+ Microsoft 365 tenants

Linha do tempo

1. gbhackers.com ↗ · pub. 27/10/2026 02:42 · coletado 27/10 03:00

   Storm-0940 abuses ConnectWise Cloud Backup credentials to compromise Microsoft 365 tenants with AI-assisted tooling

   ler a análise desta fonte ocultar

   Microsoft attributes a campaign to Storm-0940, a China-state-aligned actor, that abused compromised ConnectWise Cloud Backup (formerly SkyKick) application credentials to access Microsoft 365 tenants, escalate privileges and plant persistent credentials. Microsoft says the actor used ARTEX, an open-source agentic AI framework, to speed up attacks against more than 2,250 tenants. Huntress first disclosed the credential abuse on October 16, 2026, and its investigation supports Microsoft's account but does not independently confirm ARTEX involvement. Successful authentication and token issuance do not by themselves prove data theft, and Huntress lacked the logs needed to determine whether exfiltration occurred.

   Technical Details

   • Attackers holding the application's authentication material could request Microsoft Graph tokens using permissions already granted in customer tenants, with no interactive sign-in or MFA prompt.
   • On October 15, Huntress saw activity from 144.172.64[.]128 across almost 1,000 monitored tenants, with more than 300 successful sign-ins. This is a subset of Microsoft's broader count of more than 2,250 tenants, not a contradiction of it.
   • In two investigated tenants, the ConnectWise Cloud Management application for Microsoft Teams assigned itself Global Administrator and added secrets to other applications, including a tenant-specific Huntress application. These credentials could preserve access after the original vendor application is contained.
   • Huntress observed three patterns: scripted enumeration (tenants processed in ascending identifier order with Python-urllib/3.12), operator-directed adjustments, and background tooling that continued after its target disappeared.
   • Bursts of about 100 failed token requests within ten seconds fit parallel worker threads rather than per-request model decisions.
   • After a certificate upload failed on a thumbprint mismatch, a run 55 seconds later added retry logic, with waits roughly doubling from 3.5 to 7.1 seconds. Actions were also piloted on one tenant before being batched.
   • These patterns fit an operator modifying tooling between runs, but cannot distinguish a human, a chatbot-assisted operator or an autonomous agent. Huntress assesses LLM participation with low-to-medium confidence from telemetry alone, rising to medium-to-high when Microsoft's attribution is considered.
   • Evidence against full autonomy: after a Teams service principal was deleted, requests continued every four to eight seconds for 22 minutes without adjustment.
   • Microsoft describes ARTEX as a multi-agent framework that maps assets and weaknesses and pursues parallel attack paths. Several Storm-0940 operations reached privileged cloud access within three hours.
   • Huntress lacked Microsoft Graph activity logs from the victims, and application-only directory audit events lacked source IPs.

   Remediation

   • Turn off affected application connections without deleting evidence, and inspect service-principal sign-ins.
   • Remove unauthorized credentials and role assignments. Rotating vendor credentials alone will not remove separately planted backdoors.
   • Alert on applications assigning themselves privileged roles, unexpected credential additions and deviations from normal vendor behavior.
   • Enable Microsoft Graph activity logging where supported and correlate activity across tenants. Request cadence alone cannot reliably identify AI involvement.
2. huntress.com ↗ · pub. 26/10/2026 16:00 · coletado 26/10 18:01

   Storm-0940 abuses ConnectWise credential against M365 tenants; Huntress assesses AI agent likely adapted tooling

   ler a análise desta fonte ocultar

   Huntress published a follow-up analysis of the ConnectWise Cloud Backup credential abuse, first reported on October 16, that examines whether a person, a script or an AI agent was operating against downstream Microsoft 365 tenants. Microsoft attributes the activity to Storm-0940, which it says used ARTEX, an open-source multi-agent AI framework, to move from targeting to privileged access in under three hours. Huntress's telemetry aligns with Microsoft's findings but does not independently confirm them. Its working hypothesis is that scripted tooling did most of the work while an operator (a person, automation or an LLM agent) adapted it between runs within seconds. Huntress rates its confidence that an LLM was involved at low to medium on its own telemetry, and medium to high when Microsoft's attribution is included. Microsoft counts more than 2,250 affected tenants, while Huntress sees only the tenants it monitors.

   Technical Details

   • Scale loops: On October 15, between about 06:13 and 08:46 UTC, the credential was used against almost 1,000 tenants in ascending tenant ID order, one to six minutes apart, with the user agent Python-urllib/3.12. About 100 failed token requests hit the first 100 tenants within 10 seconds at 06:04 UTC, which is consistent with a thread pool. A second run used another application's key at 13-21 attempts per second. Both runs used secrets belonging to a single tenant, so they failed everywhere else.
   • Persistence and escalation (03:42-03:57 UTC): Secrets were added, removed and re-added. A certificate upload failed on a thumbprint mismatch. The next run added a retry loop 55 seconds later, and the same sequence ran in a second tenant 47 seconds after that. The Teams application assigned itself Global Administrator and then removed the role. When a tenant refused the removal, a different role was granted to a sibling principal and the original service principal was deleted.
   • Pilot-then-batch: From about 09:25 to 12:35 UTC, 17 hand-ordered tenants received one Graph token request each. At 13:54 UTC a script ran a fixed probe of six resources per tenant, four seconds per tenant. This pilot-then-batch pattern appeared three times across two tools.
   • Timing: First enumeration started around 01:05 UTC, and credential changes in the first tenant were complete by 03:50 UTC, under three hours.
   • Evidence against a fully autonomous agent: For 22 minutes after the Teams service principal was deleted, requests using it kept firing every 4-8 seconds and were rejected each time.
   • Visibility gaps: No victim Huntress knows of had Graph activity logging enabled. Application-only audit events carry no source IP. Huntress has no view of the actor's tooling or any model provider.
   • Microsoft's attribution: Microsoft ties the activity to Storm-0940 (active since 2021, historically using password spraying and internet-facing apps, then adding credentials to OAuth applications) and says ARTEX has been used since at least September 2026. The link rests on infrastructure: a password spray from 144.172.64[.]99 between October 10 and 14, with the same IP range appearing in the ConnectWise advisory. Huntress confirmed that spray in its telemetry (python-requests/2.34.2) but did not see azure-toolkit/1.0 or any identity or group changes in the two tenants where it holds directory audit logs.
   • Tooling clues: curl/7.88.1 is the Debian 12 default, consistent with the python:3.12 container image. Some hand-set user agents deviate from library defaults (python-requests/2.31 instead of 2.31.0, and a browser string missing (KHTML, like Gecko)).

   Remediation

   • Alert when a service principal assigns itself Global Administrator or Privileged Role Administrator, deletes itself, or when one vendor principal grants a role to a sibling.
   • Alert on credential additions to high-privilege applications from unexpected sources.
   • Baseline each vendor application's normal user agent (kiota-dotnet for the ConnectWise applications), source ranges and cadence.
   • Enable Microsoft Graph activity logs where licensing allows, and keep raw user agent strings and sub-second timestamps.
   • Correlate activity across tenants rather than within a single tenant.
3. securityweek.com ↗ · pub. 23/10/2026 07:31 · coletado 23/10 08:00

   China-linked Storm-0940 uses AI pentest framework Artex to automate ConnectWise-related intrusions into hundreds of Microsoft 365 tenants

   ler a análise desta fonte ocultar

   Microsoft reports that the China-linked APT Storm-0940 (active since at least 2021) used the open source AI penetration testing framework Artex to automate a mid-October 2026 campaign against ConnectWise customers. ConnectWise suspended several services in response, including Cloud Backup, SaaS Security and Cloud Management. Huntress observed the attackers using compromised ConnectWise application credentials to access hundreds of Microsoft 365 tenants, including over 300 Entra tenants. Since early September, Storm-0940 has used Artex against hundreds of organizations across many sectors, and earlier reporting by CrowdStrike, Zscaler and Recorded Future tied the AI-powered activity to attacks on South Korean financial institutions.

   Technical Details

   • Storm-0940 is known for password spraying and exploiting vulnerable internet-facing applications.
   • Artex accelerated reconnaissance, password spraying and OAuth application abuse. It hit over 300 accounts across eight organizations at more than 2,900 attempts per minute.
   • After the initial access, the actor used Artex to attempt sign-ins to more than 2,250 tenants. Microsoft recorded 151,000+ failed logon events, as well as successful authentications using the identities of multiple ConnectWise cloud applications.
   • In some environments the AI agents moved past authentication into Microsoft Graph and directory operations: reconnaissance, application credential modifications for persistence, and changes to identities, groups and privileged roles.
   • Modified application credentials preserve access even after the affected application is remediated.
   • Targeted sectors since September: aerospace, automotive, chemicals, defense, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software and technology, plus non-profits and think tanks.
   • Zscaler published a deep-dive covering Artex configurations, synchronization scripts, a Claude Code prompt history and network routing tools.

   Remediation

   • Examine service principal sign-ins alongside subsequent Microsoft Graph activity, directory changes and resource access.
   • Correlate suspicious events with authorized administrative activity.
   • Review application credentials for unauthorized changes, since persistence can outlive remediation of the application itself.
4. darkreading.com ↗ · pub. 22/10/2026 17:42 · coletado 22/10 20:00 só resumo do feed

   Microsoft links China-linked Storm-0940 to ConnectWise supply chain attack on 2,200+ tenants using AI-enabled pentest tool

   ler a análise desta fonte ocultar

   Microsoft has attributed a supply chain attack involving ConnectWise to Storm-0940, a China-linked actor. According to the report, the actor used an AI-enabled penetration-testing tool to automate and accelerate the attack, which targeted more than 2,200 tenants. The article excerpt provides no further detail on the intrusion method, the affected ConnectWise products, or the impact on victims.

   Technical Details

   • Attribution: Storm-0940 (Microsoft designation), described as China-linked.
   • Tooling: an AI-enabled penetration-testing tool used to automate and speed up the attack (the specific tool is not named in the available text).
   • Scale: more than 2,200 tenants.
   • No CVEs, IOCs or specific ATT&CK techniques are stated in the available text.
5. securityaffairs.com ↗ · pub. 22/10/2026 17:47 · coletado 22/10 20:00

   Storm-0940 uses AI pentesting tool ARTEX to hit 2,250 M365 tenants via ConnectWise Cloud Backup supply chain compromise

   ler a análise desta fonte ocultar

   Microsoft attributes the recent ConnectWise Cloud Backup supply chain compromise of a multi-tenant application to Storm-0940, a China state-aligned group active since 2021. The actor used ARTEX, an AI-driven penetration testing framework, to run attacks at machine speed against organizations in aerospace, defense, energy, financial services, government and manufacturing. In several cases the time from initial targeting to privileged cloud access was under 3 hours. The article reports that about 2,250 Microsoft 365 tenants were targeted at up to 2,900 sign-in attempts per minute.

   Technical Details

   • Between October 10 and 14, Storm-0940 ran a password spraying campaign from 144.172.64[.]99: more than 151,000 failed logins against 327 accounts at eight organizations, peaking at 2,900 failed attempts per minute on October 11. Forty-eight accounts received over 1,000 attempts each. None succeeded.
   • On October 15, one day after the ConnectWise breach became public, the AI agents stopped spraying. They used stolen credentials of several ConnectWise cloud application accounts to log into customer Microsoft 365 environments through applications that already had access, with no interactive user sign-in.
   • In a subset of environments the agents ran directory reconnaissance via Microsoft Graph, modified application credentials for persistence, and attempted changes to identities, groups and privileged roles.
   • Credentials added to trusted applications can remain active as a backdoor even after the compromised application is remediated.
   • ARTEX is written in Go, can use different AI models, and was originally open source; the project later went closed-source, but existing copies remain usable. Threat actors in several regions use it. Zscaler and Recorded Future reported a Chinese-speaking group using it against South Korean financial institutions, with DeepSeek, GLM and Grok as coordinated agents.

   Remediation

   • Review all service principal and application credential additions since at least October 1, not only since October 15.
   • Revoke or rotate any credentials added by unknown parties, even if the ConnectWise connections are already disabled.
   • Audit Microsoft Graph activity, and changes to identities, groups and privileged roles, in affected tenants.
6. techcrunch.com ↗ · pub. 22/10/2026 13:47 · coletado 22/10 15:00

   China-aligned hackers breach ConnectWise cloud backup, steal app credentials and use AI agents to compromise ~2,250 customer organizations

   ler a análise desta fonte ocultar

   Microsoft researchers report that China state-aligned hackers breached ConnectWise's cloud backup service and stole application credentials used to link ConnectWise with its customers' Microsoft-hosted environments. With these credentials the attackers could sign in as authorized users and access emails and other files. Microsoft says the actors used AI agents to compromise around 2,250 organizations at nearly 3,000 attempted sign-ins per minute, leaving defenders little time to detect and respond. ConnectWise has paused access to the cloud backup system, is investigating, and said on Thursday it was working to restore the service.

   Technical Details

   • Initial compromise: ConnectWise's cloud backup service; stolen application credentials that establish data links between ConnectWise and customer environments.
   • Abuse: the credentials allowed logins to customers' Microsoft-hosted environments as authorized users, exposing emails and files.
   • Tooling: the speed is attributed to AI agents built on ARTEX, an open source AI framework that works with AI models to stress-test cyber defenses. The article says the same software was used in a recent compromise of South Korea's financial systems, many of which had weak security and lacked multi-factor authentication.
   • The article does not name the threat actor or provide IOCs or CVEs.

   Remediation

   • The article gives no customer guidance beyond ConnectWise pausing cloud backup access and working on restoration.
   • Defenders using the service should watch for anomalous high-rate sign-ins and application-credential use in their Microsoft environments, and enforce multi-factor authentication.
7. theregister.com ↗ · pub. 22/10/2026 08:28 · coletado 22/10 10:00

   Storm-0940 uses ARTEX AI tool and compromised ConnectWise app credentials to target 2,250+ Microsoft 365 tenants

   ler a análise desta fonte ocultar

   Microsoft attributes the recent ConnectWise security incident to Storm-0940, a China-linked espionage group active since at least 2021. The actor used the open source AI penetration-testing framework ARTEX and compromised ConnectWise application identities to attempt authentication against more than 2,250 Microsoft 365 tenants. Most attempts failed, but Microsoft says the group established persistent privileged access at numerous organizations, in some cases less than three hours after selecting a target. Microsoft has not disclosed how many customers were compromised or whether data was stolen. ConnectWise suspended its Cloud Backup, SaaS Security and Cloud Management services and says it has contained the affected application connections and is gradually restoring service.

   Technical Details

   • ARTEX is an open source Go framework that uses AI agents to automate reconnaissance, vulnerability discovery, credential attacks and data theft. Storm-0940 has used it since at least September against government agencies, defense contractors, banks, manufacturers and tech firms worldwide. Microsoft has also seen actors from several regions using it.
   • Between October 10 and 14, the actor made more than 151,000 failed sign-in attempts (password spraying) against 327 accounts at eight organizations, with no successful logins observed.
   • The actor then pivoted to compromised ConnectWise application credentials, abusing permissions customers had already granted to ConnectWise services without needing an interactive user login.
   • Authentication attempts reached up to 2,900 per minute against more than 2,250 tenants.
   • Microsoft observed AI-accelerated activity through Microsoft Graph, including reconnaissance, application credential changes and attempts to modify privileges, potentially allowing persistence after the original credentials were revoked.
   • Microsoft cautions that a successful login does not necessarily mean data was accessed. The article says nothing suggests a link to ConnectWise's May 2025 nation-state breach affecting ScreenConnect.

   Remediation

   • Shutting down the affected ConnectWise application connections does not necessarily remove attackers who already established a foothold in customer environments.
   • Customers should review ConnectWise-linked application permissions and application credential or privilege changes in their Microsoft 365 tenants, since the article indicates attackers may have persisted after the original credentials were revoked.
8. infosecurity-magazine.com ↗ · pub. 22/10/2026 08:00 · coletado 22/10 08:01

   Storm-0940 uses ARTEX agentic AI framework to compromise ConnectWise Microsoft 365 tenants and target downstream customers

   ler a análise desta fonte ocultar

   Microsoft assesses that the China-aligned actor Storm-0940 used the agentic AI penetration testing framework ARTEX to compromise the Microsoft 365 tenants of ConnectWise, then pivoted to its downstream customers. The campaign began in September 2026 and targeted hundreds of organizations worldwide across aerospace and defense, energy, financial services, government, semiconductor, software and other sectors. The actor often gained privileged cloud access in under three hours from initial targeting. ConnectWise detected suspicious activity on October 15 and unauthorized access to application identities in its Cloud Backup environment on October 17. It took Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management offline, and began a phased restoration of Cloud Backup on October 22.

   Technical Details

   • Storm-0940 has been active since 2021 and focuses on data theft. Its initial access relies on password spraying and exploitation of internet-facing applications. It persists in cloud environments by adding credentials to existing OAuth applications.
   • After accessing the ConnectWise multi-tenant application, the actor used ARTEX to accelerate scanning and reconnaissance, password spraying and OAuth application abuse against customer tenants.
   • The group attempted sign-ins to more than 2,250 tenants at about 2,900 attempts per minute.
   • Using stolen app credentials, the AI agents authenticated to customer environments from the same IP range, abusing the trust those apps already had within each tenant.
   • Microsoft observed follow-on activity in multiple customer environments: reconnaissance, application credential modifications for persistence, and changes to identities, groups and privileged roles.
   • ARTEX is a multi-agent LLM framework that works with any AI model and automates offensive workflows from reconnaissance to data exfiltration, storing discovered assets and vulnerabilities in a graph. Its interface defaults to English but can be switched to Korean, Mandarin, Spanish or Japanese.
   • CrowdStrike reported in October 2026 that a China-based actor used ARTEX against South Korean financial organizations, resulting in data exfiltration.
   • ConnectWise states that existing backup archives remain encrypted, isolated and preserved, with no indication of compromise, and that there is no evidence other products are affected.

   Remediation

   • Review individual Microsoft 365 tenants for unauthorized changes or persistent access, including OAuth application credentials, identities, groups and privileged roles.
   • Keep affected ConnectWise connections disabled until ConnectWise issues formal, service-specific reconnection instructions.
9. thehackernews.com ↗ · pub. 22/10/2026 01:21 · coletado 22/10 04:00

   Storm-0940 uses ARTEX agentic AI framework in ConnectWise Cloud Backup supply chain attack on hundreds of organizations

   ler a análise desta fonte ocultar

   Microsoft attributed the recent supply chain compromise of the ConnectWise Cloud Backup application to Storm-0940, a China state-aligned actor. The actor used ARTEX, a Go-based agentic AI penetration testing framework, to automate reconnaissance, password spraying and OAuth application abuse at "machine speed" against hundreds of organizations worldwide since September 2026. After the actor took over the identities of multiple ConnectWise cloud applications on October 15, 2026, it used the trust those apps already held in customer tenants to authenticate without interactive sign-in. In several cases the time from initial targeting to privileged cloud access was under 3 hours. Microsoft says other threat actors in multiple regions are also weaponizing ARTEX, and Recorded Future and Zscaler link it to earlier, apparently financially motivated attacks on South Korean financial institutions. ConnectWise temporarily shut down services and is restoring them in phases over several days.

   Technical Details

   • ARTEX was made closed-source after its abuse against South Korean financial institutions. Zscaler ThreatLabz analyzed a custom deployment that used DeepSeek, GLM and Grok models via an OpenAI-compatible gateway, with multi-agent cross-review prompts and a Claude Code prompt history.
   • Between October 10 and 14, 2026, infrastructure at 144.172.64[.]99 ran a cross-tenant password-spray campaign against 327 accounts across eight organizations, targeting Microsoft 365 and Exchange Online. Microsoft captured more than 151,000 failed logons, peaking at 2,900 per minute on October 11 (over 111,000 failures that day). 48 accounts received more than 1,000 failures. No successful authentication was detected in that window.
   • ARTEX attempted sign-ins against more than 2,250 tenants at up to 2,900 attempts per minute.
   • On October 15, 2026, the agents gained control of multiple ConnectWise cloud application identities and used the same IP range to authenticate to customer environments via the stolen app credentials.
   • Follow-on activity included Microsoft Graph and directory operations, reconnaissance, application credential modifications for persistence, and changes to identities, groups and privileged roles. These credential changes can persist as a backdoor even after the compromised application is remediated.
   • Storm-0940 has been active since at least 2021. It uses the Quad7 (CovertNetwork-1658) botnet for password spraying, exploits internet-facing applications, and adds credentials to existing OAuth apps for persistence.
   • Targeted sectors: aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, think tanks and non-profits.
   • Recorded Future Insikt Group tracks the South Korea-focused cluster as TAG-217, with activity dating to August 17, 2026. It also built tooling against YiiMP cryptocurrency mining operations and set up a workspace for iPhone vulnerability testing and Android system modification. Prompt histories included requests for bulk personal and transaction data, payment gateway API keys and NFT minting workflow exploitation.

   Remediation

   The article gives no formal remediation steps. Its implications for defenders:

   • Block or monitor the cited infrastructure 144.172.64[.]99.
   • Audit ConnectWise-related application identities and OAuth credentials in Microsoft 365 tenants.
   • Review recent application credential changes and privileged role modifications.
   • Detect high-rate password spraying, given the short detection window.
   • MSPs should treat their own environments as an access path into every client they serve.
10. cyberscoop.com ↗ · pub. 21/10/2026 18:58 · coletado 21/10 20:00

    China-aligned Storm-0940 used ARTEX AI agents in ConnectWise Cloud Backup supply-chain attack on Microsoft 365 tenants

    ler a análise desta fonte ocultar

    Microsoft attributed the recent supply-chain attack on ConnectWise customers' Microsoft 365 environments to Storm-0940, a China-state aligned actor active since 2021. Since at least September 2026 the group has used the open-source agentic AI penetration testing framework ARTEX to automate attacks against hundreds of organizations worldwide. After a failed password-spraying wave, it compromised ConnectWise Cloud Backup and used it to reach downstream customer tenants. Microsoft has not said how many customers were compromised and cautions that successful authentication does not necessarily mean data access or theft. ConnectWise shut down services on Saturday and began phased restoration on Wednesday, expecting recovery to take several days.

    Technical Details

    • Over the four days ending Oct. 14, Storm-0940 targeted 327 Microsoft 365 and Exchange Online accounts across eight organizations, with more than 151,000 failed logons, peaking at 2,900 failures per minute.
    • The next day it turned to ConnectWise, using the same malicious infrastructure and AI agents against Cloud Backup customers' Microsoft 365 environments.
    • ARTEX reached more than 2,250 tenants at about 2,900 sign-in attempts per minute.
    • It accelerated scanning and password spraying and abused OAuth applications in downstream victims.
    • In some environments the agents went beyond authentication to Microsoft Graph and directory operations: reconnaissance, application credential modifications for persistence, and changes to identities, groups and privileged roles.
    • ARTEX is described as LLM-driven agents that run an autonomous penetration test from reconnaissance to exfiltration, and works with any AI model. Microsoft says multiple actors from various regions use it.
    • Targeted sectors: aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks and non-profits.

    Remediation

    • ConnectWise advised customers to keep their connections disabled while phased recovery continues.
    • Review Microsoft 365 tenants for evidence of follow-on activity, especially unexpected changes to application credentials, groups and privileged roles, and audit high-privilege third-party OAuth applications.
11. infosecurity-magazine.com ↗ · pub. 19/10/2026 07:30 · coletado 20/10 16:31

    ConnectWise suspends Cloud Backup, SaaS Security and Cloud Management after attackers access Microsoft 365 application identities

    ler a análise desta fonte ocultar

    ConnectWise took several cloud services offline, including Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management, after finding unauthorized access to application identities in the ConnectWise Cloud Backup environment. The company began investigating suspicious activity on October 15 and confirmed the unauthorized access by October 17. Attackers could potentially use these application credentials to reach customers' Microsoft 365 tenants with the permissions granted to the backup app. Huntress observed that in at least one customer tenant the attacker assigned themselves the Global Administrator role and tried to change permissions for other applications. ConnectWise reports no indication yet that partner backup data was compromised, has no restoration time and declined to discuss attribution.

    Technical Details

    • The attacker authenticates as the application itself, using the tenant tooling the same way the backup service would, and obtains tokens carrying the app's existing permissions.
    • This is an application sign-in, so MFA does not apply. As Justin Kohler (SpecterOps) noted, no user, device or MFA prompt is involved.
    • Backup apps typically have broad read/restore access to mailboxes, OneDrive and SharePoint files, Teams data and directory information.
    • Huntress saw a Global Administrator role self-assigned in at least one tenant, followed by attempts to modify permissions of other applications, including an MSP management application and Huntress's own security application.
    • No attribution has been made, and no IOCs were published in the article.

    Remediation

    • Verify the status of the listed application connections and keep affected applications disabled until ConnectWise provides restoration instructions.
    • Preserve sign-in and audit records promptly, while taking any urgent containment action.
    • Review application and user authentication, application credentials, federation trusts, directory roles, owners, consent grants and recent policy changes.
    • Check for unauthorized mailbox forwarding, inbox or transport rules and delegated mailbox access.
    • Investigate other identities changed or used during suspicious activity; disabling the original applications does not remove those separate access paths.
12. huntress.com ↗ · pub. 16/10/2026 20:00 · coletado 20/10 16:30

    ConnectWise Cloud Backup (SkyKick) vendor credential abused to access 162+ Microsoft 365 tenants and plant persistence

    ler a análise desta fonte ocultar

    Huntress reports that a stolen vendor credential for ConnectWise Cloud Backup (formerly SkyKick) was used on October 15, 2026 to obtain Microsoft Graph tokens in customer Microsoft 365 tenants from the hosting IP 144.172.64[.]128. As of 19:00 UTC on October 16, Huntress had confirmed unauthorized sign-ins in 162 tenants. Later updates found almost 1,000 Entra tenants with sign-in activity from the IP, over 300 of them successful. The credential was a client assertion, so it lives in the vendor's own tenant and customers could not have caused the compromise. Post-compromise activity in two tenants was scripted and indiscriminate: the app granted itself Global Administrator and planted secrets on other applications, including Huntress's own app. Unauthorized secrets were added to a Huntress application in one customer tenant. ConnectWise acknowledged the incident and, per the October 17 update, disabled the relevant apps. Huntress also saw a second, targeted wave against 16 tenants in the policy, national security, trade and critical minerals sectors. No attribution is made.

    Technical Details

    • Timeline: Password spraying against four law firm tenants from the same IP on Oct 13-14 (curl/7.88.1; two accounts locked out). From 01:58 UTC on Oct 15, ConnectWise Cloud Management service principals assigned themselves directory roles (mostly Exchange Administrator) in ~50 tenants, using the vendor-typical kiota-dotnet user agent. Between 03:44 and 03:49 UTC, the Cloud Management MS Teams app added itself to Global Administrator in one tenant, then a Python script (Python-urllib/3.12) added client secrets (expiring 2028) to an MSP management app and the Huntress Security Platform app. A certificate addition failed with a thumbprint mismatch.
    • Token theft: Between 06:13 and 08:34 UTC, the app authenticated from 144.172.64[.]128, walking tenants in sorted GUID order, which indicates a script working from a target list. The last confirmed successful sign-in was at 08:44 UTC on Oct 15.
    • Targeted wave: On Oct 15 the actor swept 16 tenants for SkyKick Graph tokens (09:25-12:35 UTC). A second, apparently manual sweep (13:54-14:20 UTC) targeted Exchange Online, SharePoint, Teams, Azure Resource Manager, Entra and the O365 Management APIs. Attempts failed where the service principal was absent.
    • Post-compromise behavior: In two tenants, self-granted Global Administrator and secret planting occurred within two minutes of each other around 03:45 UTC on Oct 15. Target apps looked randomly chosen. Access from private Azure IPv6 space, not the known IP, was used to add the Huntress app credential. Huntress removed it on Oct 16 and enabled App Instance Property Lock on its apps.
    • Visibility gaps: Microsoft Graph directory reads leave no audit trail, and app-only audit events carry no source IP. No mailbox, file, user or policy changes were seen in the reviewed tenants, but data access cannot be ruled out.
    • ATT&CK mapping: T1078.004 (valid cloud accounts), T1098.003 (additional cloud roles), T1098.001 (additional cloud credentials).
    • Affected apps: ConnectWise Cloud Backup 506e08f9-6e9a-4da4-942b-a099a03644ae; Cloud Management 2399d300-6fca-4e6a-a686-399fefe75b83; MS Teams 24205314-2b89-4e07-a2a4-579e898a5640; Exchange Online b78f6a77-d4e5-46fb-87e5-d1648bd02519; MS Graph 0de14c77-b9b0-4137-9360-34878a929827; Partner Center 412dcf96-176d-4b3a-a1b0-4981ad66971e; SharePoint Online b2b55f5b-7758-4719-8d8f-88ae172e6bdb. Older tenants may show "SkyKick Cloud Manager".

    Remediation

    • Disable (do not delete) the ConnectWise/SkyKick enterprise applications in Entra, even if logs look clean. Deleting removes consent.
    • Review service principal sign-ins from roughly 01:00 UTC Oct 15 to 02:00 UTC Oct 16. Look for any non-Microsoft/Azure IP, especially 144.172.64[.]128.
    • Remove directory roles not intentionally granted to these apps, including Global Administrator and Privileged Authentication Administrator.
    • Audit client secrets and certificates on all enterprise apps and app registrations, especially MSP management and security tools, for any added since Oct 13. Remove unexpected ones.
    • Check Entra audit logs for "Add member to role", "Update application" and "Add service principal credentials" by these apps, and check user agents (kiota-dotnet is vendor-typical; Python-urllib/3.12 is not).
    • Review Conditional Access exclusions for these apps. Do not re-enable them until ConnectWise confirms all credentials are reset. Consider application management policies to restrict client secrets.
13. cyberscoop.com ↗ · pub. 20/10/2026 13:17 · coletado 20/10 14:00

    ConnectWise Cloud Backup supply-chain attack: compromised API secret used against hundreds of Microsoft 365 tenants

    ler a análise desta fonte ocultar

    A threat actor obtained a highly sensitive API secret for ConnectWise Cloud Backup (formerly SkyKick) and used it to sign in to customers' Microsoft 365 tenants, forcing ConnectWise to suspend its Cloud Backup, SaaS Security and Cloud Management services. Huntress saw sign-in activity from the malicious infrastructure across almost 1,000 Entra tenants, with more than 300 sign-ins appearing to succeed. It confirmed unauthorized sign-ins in 162 tenants and expects further compromises beyond its telemetry. The actor is unattributed and no one has claimed responsibility. ConnectWise has not explained how the credential was obtained and has given no restoration timeline.

    Technical Details

    • The credential belongs to a multi-tenant application, so anyone holding it can request access tokens in any tenant where the application is installed, with no customer action and bypassing MFA.
    • Affected Microsoft 365 workloads include Exchange Online, Teams, SharePoint Online, Cloud Backup, MS Graph and Partner Center. Todyl reports the access allowed reading and writing mail and files.
    • The sign-ins were performed by an automated tool. Microsoft Threat Intelligence observed broad successful sign-ins from a malicious IP address on Oct. 15.
    • Follow-on activity included Microsoft Graph API reconnaissance, privilege self-elevation by the application's account, and attempts to add credentials to the related service principal and other applications to keep backdoor access even after the original application is disabled.
    • Huntress saw the first wave on Friday. ConnectWise began mitigations on October 17 at 05:00 UTC and says it has seen no successful threat activity in the environments it monitors. It stresses that each partner or customer tenant still requires review.

    Remediation

    • Disable the affected ConnectWise applications in Microsoft 365 tenants even if logs show nothing unusual.
    • Hunt for malicious activity using the IOCs shared by ConnectWise and researchers.
    • Review service principals and application credentials for unexpected additions or privilege changes.
    • Review Entra sign-in logs and Graph API activity for the application identities.
14. thehackernews.com ↗ · pub. 20/10/2026 07:56 · coletado 20/10 10:00

    ConnectWise Cloud Backup Application Identities Compromised, Backdoored Entra Apps Seen in Microsoft 365 Tenants

    ler a análise desta fonte ocultar

    ConnectWise said it is still responding to a security incident involving unauthorized access to application identities tied to Cloud Backup. The incident was identified on October 14, 2026, and mitigations began rolling out on October 17. The company has disabled the affected application connections, suspended Cloud Backup, and suspended SaaS Security and Cloud Management as a precaution because both integrate with it. It has also reset accounts, replaced application credentials, strengthened administrative-access protections and engaged independent third-party incident responders. Huntress confirmed post-compromise activity in two Microsoft 365 tenants, where the application granted itself Global Administrator and planted new secrets on other applications for persistence. ConnectWise says it has seen no successful threat activity in the environments it monitors, and it has not established which partner or customer tenants are affected.

    Technical Details

    • Huntress reviewed application sign-ins across more than 10,000 tenants with ConnectWise applications. Only 144.172.64[.]128 and Microsoft-internal ranges produced application sign-in activity. The address was used with a vendor credential and is the primary vector.
    • Related addresses in the same provider range (AS14956, RouterHosting) showed password spray or failed logins, which Huntress considers unlikely to be related to the application sign-in activity: 144.172.64[.]99 (concentrated spray, October 10 to 14, 2026), 144.172.64[.]60 (a few failed logins, October 18) and 144.172.94[.]243 (broad, ongoing spray against many organizations).
    • In the second compromised tenant, the application granted itself Global Administrator and added a new secret to a small number of other applications registered in the tenant. Huntress found no apparent selection logic: two different sets of applications were chosen in the two tenants, regardless of what those applications could do.
    • Access may have been used for Microsoft Graph directory reads. There are no signs of mailbox or file manipulation, or of user or policy changes.

    Remediation

    • Do not reconnect affected applications until ConnectWise publishes formal restoration instructions.
    • Review each potentially affected Microsoft 365 tenant. Preserve evidence, validate findings and assess operational impact before making changes.
    • Use ConnectWise's published technical guidance to investigate partner and managed-customer environments. Look for unexpected Global Administrator grants and newly added application secrets.
    • Hunt for sign-ins from the listed IP addresses. A clean result does not guarantee a tenant is unaffected.
15. darkreading.com ↗ · pub. 19/10/2026 16:19 · coletado 19/10 19:00 só resumo do feed

    ConnectWise disables cloud backups as attackers reportedly use its credentials to authenticate into Microsoft 365 tenants

    ler a análise desta fonte ocultar

    ConnectWise has disabled its cloud backup offering amid concern for downstream managed service providers (MSPs) and their customers. Researchers say attackers authenticated into Microsoft 365 tenants using ConnectWise credentials. ConnectWise says customer impact remains unconfirmed. The available article text is limited to the headline and a short summary, so the initial access method, the scale of the compromise, any attribution and the affected product versions are not stated. Because MSP-linked credentials can give access to many downstream tenants, this is a potential supply-chain risk for MSP customers.

16. theregister.com ↗ · pub. 19/10/2026 01:31 · coletado 19/10 17:54

    ConnectWise suspends Cloud Backup, SaaS Security and Cloud Management after compromise of app identities; Huntress sees M365 tenant takeover

    ler a análise desta fonte ocultar

    ConnectWise disclosed on October 16 that on October 15 it detected unauthorized access to application identities in its Cloud Backup (formerly SkyKick) environment. It suspended Cloud Backup, plus the integrated SaaS Security and Cloud Management services, as a precaution. As of 16:00 UTC on October 18 the services were still down, so end users cannot back up, access or restore data. Huntress says a Microsoft 365 credential (API secret) belonging to ConnectWise Cloud Backup was compromised and is being used to access customers' M365 environments. ConnectWise has not discussed attribution and says existing archives remain encrypted, isolated and show no evidence of unauthorized access.

    Technical Details

    • Huntress observed, in one partner tenant, the ConnectWise application Cloud Management - MS Teams (Application ID 24205314-2b89-4e07-a2a4-579e898a5640) grant itself Global Administrator. It then added new credentials to two other applications in that tenant, one of them a single-tenant Huntress application.
    • Disabling the abused M365 apps does not remove credentials that were already added.
    • ConnectWise published IOCs tied to a handful of IP addresses and third-party app integrations; the article does not list them. It also disabled some integrations between Cloud Backup and Exchange, Teams, SharePoint Online and its own products.
    • The downstream exposure is hard to scope because ConnectWise does not know which M365 tenants its MSP partners manage, and end-user organizations may not know an MSP uses ConnectWise.

    Remediation

    • Review the credentials on all M365 applications, not just the ConnectWise ones, and remove any unrecognized ones.
    • MSPs should check the M365 environments they manage for signs of compromise, using the IOCs published by ConnectWise.
    • Disabling the ConnectWise apps alone is not sufficient.
17. securityaffairs.com ↗ · pub. 19/10/2026 06:32 · coletado 19/10 17:54

    Stolen ConnectWise Cloud Backup app credentials used to access Microsoft 365 tenants; services suspended

    ler a análise desta fonte ocultar

    ConnectWise suspended its Cloud Backup (formerly SkyKick) service and took SaaS Security and Cloud Management offline after unknown attackers obtained unauthorized access to seven of its application identities. The company detected the incident on October 14, disabled the compromised identities on October 17, and is still investigating how the credentials were obtained. Because the applications already held permissions in customer Microsoft 365 tenants, the attackers could impersonate them and request tokens from Microsoft Entra ID without needing any customer passwords. Huntress observed malicious sign-ins from 144.172.64.128 and a later manual, targeted wave against 16 tenants in the policy, national security, trade and critical minerals sectors, all of which failed.

    Technical Details

    • Depending on granted permissions, attackers could reach mailboxes, SharePoint documents, Teams messages and directory data.
    • Huntress saw malicious sign-ins from 144.172.64[.]128 through October 15 at about 14:20 UTC. A second, apparently manual wave hit Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra and Office 365 Management APIs in rapid succession; all 16 attempts failed.
    • Of about 1,000 Entra tenants with sign-in activity from the suspicious IP, around 300 sign-ins succeeded. Some could not proceed because the required service principal was missing in the tenant.
    • Persistence risk: an attacker could add a client secret to another trusted application or create a new application and grant it permissions. In one tenant, an application able to assign directory roles could make itself Global Administrator, allowing it to add credentials, reset passwords and authentication methods, and change Conditional Access policies.
    • ConnectWise revoked the certificates used for affected application connections. This stops new authentication but does not reverse changes already made in a tenant.
    • ConnectWise says Cloud Backup archives remain encrypted and isolated, with no evidence they were accessed. Backups are not running and restores are unavailable while the service is suspended.

    Remediation

    • Review your own and every managed customer Microsoft 365 tenant, including those with dormant SkyKick connections, for sign-ins from 144.172.64[.]128 starting October 13.
    • Preserve sign-in and audit logs before containment, since containment steps can overwrite evidence.
    • Check application credentials and federation trusts, directory role assignments, consent grants, recent policy changes, mailbox forwarding rules and delegated mailbox access.
    • Rotating the vendor credential is necessary but not sufficient, because attackers may have created alternate access paths.
18. gbhackers.com ↗ · pub. 17/10/2026 09:27 · coletado 19/10 17:54

    ConnectWise Cloud Backup (SkyKick) credentials abused to access 162 Microsoft 365 tenants; backup service access shut off

    ler a análise desta fonte ocultar

    Attackers used compromised application credentials from ConnectWise Cloud Backup (formerly SkyKick) to access Microsoft 365 customer environments. Huntress researcher Jonathan Semon confirmed unauthorized sign-ins across 162 tenants as of 19:00 UTC on October 16. ConnectWise disabled application access, which interrupted backup services, and said it has no indicators that stored partner backup data was compromised. Data theft is unconfirmed, but the application holds broad permissions, so exposure may extend to every organization that has consented to it.

    Technical Details

    • On October 15, between 06:13 and 08:34 UTC, the attacker used the compromised application credential to obtain Microsoft Graph tokens from hosting-provider IP 144.172.64[.]128. Requests moved through tenants in sorted identifier order, seconds apart, which suggests automated targeting.
    • Authenticating as the trusted application meant inheriting the permissions already approved in each tenant. The application covers Microsoft 365 mailboxes, OneDrive, SharePoint, Teams and directory information.
    • In one partner tenant, a second application, ConnectWise Cloud Management – MS Teams, assigned itself Global Administrator and then added client secrets to two other applications: an MSP management application and a partner-specific Huntress Security Platform application. The secrets were set to expire in 2028, giving persistence independent of the original credential.
    • These changes happened about 2.5 hours before the observed public-IP authentications. Huntress has not established that both activity sequences involved the same operator. A logged private IPv6 address cannot identify the operator.
    • Absence of visible mailbox or file activity does not prove safety, because directory reads lack audit visibility.

    Remediation

    • Disable, rather than delete, ConnectWise Cloud Backup application 506e08f9-6e9a-4da4-942b-a099a03644ae and Cloud Management – MS Teams application 24205314-2b89-4e07-a2a4-579e898a5640. Review other ConnectWise applications.
    • Inspect Microsoft Entra service principal sign-in logs for suspicious authentication, including from 144.172.64[.]128. Investigate unexpected directory-role assignments and application modifications.
    • Review client secrets and certificates across application registrations and enterprise applications. Remove unauthorized credentials added since October 13 and revoke unexpected privileges, since disabling the vendor applications does not remove planted secrets.
    • Keep affected applications disabled until ConnectWise confirms credential resets. Existing stored backups are not deleted, but plan for the backup interruption.
19. securityweek.com ↗ · pub. 19/10/2026 10:16 · coletado 19/10 17:53

    ConnectWise suspends cloud services after compromised Cloud Backup credential used to access hundreds of Microsoft 365 tenants

    ler a análise desta fonte ocultar

    ConnectWise suspended its Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management services on October 17-18 after attackers abused a compromised application credential to access customers' Microsoft 365 tenants. Huntress saw the Cloud Backup identity sign in to 162 M365 tenants between October 15 and 16. By October 17 it had found sign-ins from the attacker's IP in nearly 1,000 Entra tenants, with more than 300 successful. ConnectWise says customer backups remain encrypted and it has no evidence they were accessed. It has given no restoration timeline, so scheduled backups, restores, monitoring and license management remain disrupted.

    Technical Details

    • The credential type was a client assertion, meaning it lives in the vendor's own tenant and customer actions could not have produced it (per Huntress).
    • The source IP 144.172.64[.]128 obtained Microsoft Graph tokens in customer tenants on October 15 between 06:13 and 08:34 UTC. The actor moved through tenants in sorted GUID order, which suggests a script working from a target list.
    • The same IP was used October 13-14 in password spraying and scripted sign-in attempts against four law firm tenants.
    • In one tenant, the ConnectWise Cloud Management app for Microsoft Teams added itself to the Global Administrator role on October 15. It then ran a Python script that added client secrets to an MSP management application and to Huntress's own application. This came from Microsoft's internal cloud network about 2.5 hours before the first sign-ins from the attacker IP. Huntress has not tied the two phases to the same operator.
    • Huntress is highly confident the actor also abused the Cloud Management Exchange Online, MS Teams and SharePoint Online applications. ConnectWise has shut all three down.
    • Sign-ins succeeded only where the relevant ConnectWise service principal existed in the tenant.

    Remediation

    • Review M365/Entra tenants for sign-ins from the published IP addresses and for activity by the ConnectWise service principals.
    • Check for unexpected Global Administrator role assignments, new client secrets and other configuration changes or persistence. ConnectWise has published guidance for reviewing MSP Microsoft 365 environments.
    • Do not assume Microsoft backs up tenant configuration automatically.
20. bleepingcomputer.com ↗ · pub. 17/10/2026 12:18 · coletado 19/10 17:53

    ConnectWise Cloud Backup (SkyKick) supply-chain attack abuses service principals to breach Microsoft 365 tenants

    ler a análise desta fonte ocultar

    ConnectWise shut down its Cloud Backup service (formerly SkyKick Cloud Backup) after an attacker gained unauthorized access to application identities and used them to compromise Microsoft 365 tenants. Huntress identified at least 162 compromised tenants in its environment, and Microsoft Threat Intelligence characterized the incident as an active supply-chain attack. Activity began at least on October 13-15, 2026, from a single IP address, 144.172.64[.]128. The victim count, the extent of data theft and the way the attacker obtained the vendor credentials remain unclear. As of October 18, Cloud Backup, SaaS Security and Cloud Management remain offline, and ConnectWise reports no evidence that stored backup archives were compromised.

    Technical Details

    • The attacker authenticated directly to Microsoft 365 as the backup application using its secret, via automated scripts. These were non-interactive service principal sign-ins, so MFA was ineffective.
    • The app's previously granted permissions (Microsoft assesses this likely included Directory.ReadWrite.All) allowed reading and writing mail, OneDrive/SharePoint files and Teams chats.
    • Huntress saw ConnectWise Cloud Management service principals (Exchange Online, Teams, Graph) assign themselves directory roles, mostly Exchange Administrator, in nearly 50 tenants. In one tenant, "Cloud Management - MS Teams" granted itself Global Administrator and added credentials to an MSP management tool and to Huntress's own application, in about five minutes.
    • Microsoft observed backdoor persistence, Microsoft Graph API reconnaissance and attempts to add further credentials. Todyl found only sign-in activity in nine tenants it analyzed.
    • Source IP: 144.172.64[.]128, also linked to scripted sign-ins on October 13-14 with user agent curl/7.88.1. Other user agents: python-urllib/3.12, python-requests/2.31, python-requests/2.34.2.
    • Legitimate Cloud Backup app ID abused: 506e08f9-6e9a-4da4-942b-a099a03644ae. Other ConnectWise Cloud Management app IDs to check are listed in the IOC field.

    Remediation

    • Review service principal sign-ins in Entra filtered by the Cloud Backup application ID, and look for unexpected source addresses.
    • Disable the implicated ConnectWise applications. Older tenants may list them as "SkyKick Cloud Manager".
    • Review secrets and certificates across all applications for unauthorized additions since October 13 and remove them. The vendor shutdown does not remove credentials already planted in tenants.
    • Review application credential changes, OAuth grants, directory role assignments and Graph activity.
    • Existing tokens remain valid until they expire, and revoking user sessions does not end application-based access.
21. thehackernews.com ↗ · pub. 17/10/2026 03:16 · coletado 19/10 17:53

    Compromised ConnectWise Cloud Backup (SkyKick) OAuth app credential used to access 173+ Microsoft 365 tenants

    ler a análise desta fonte ocultar

    An active supply chain attack is abusing a compromised credential for the ConnectWise Cloud Backup (formerly SkyKick) Microsoft 365 OAuth application, giving unknown actors access to customer tenants. Huntress confirmed unauthorized sign-ins in 173 partner/customer tenants, and Microsoft reports broad successful service principal authentication on October 15, 2026 from 144.172.64[.]128. The app holds broad consented permissions (mailboxes, OneDrive, SharePoint, Teams, directory data), so the attacker inherits that access in every tenant where it is installed. ConnectWise has shut off Cloud Backup application access and says it has found no evidence that partner backup data was compromised; the investigation is ongoing. The article also briefly covers a separate campaign: the UNC7017 tampering of AOMEI Backupper update infrastructure to deliver CROSSROAD and SHINYROAD.

    Technical Details

    • The actor authenticated as the app using its own tooling and obtained Microsoft Graph tokens from 144.172.64[.]128 on October 15 between 06:13 and 08:34 UTC, moving through tenants in sorted GUID order a few seconds apart, which suggests a script working from a target list.
    • The same IP password-sprayed four law firm tenants on October 13-14, 2026; Huntress saw no successful user sign-ins.
    • In at least one partner tenant, the ConnectWise Cloud Management app for Teams (24205314-2b89-4e07-a2a4-579e898a5640) added itself to Global Administrator, then ran a Python script (User-Agent Python-urllib/3.12) that added new client secrets to an MSP management application and to Huntress's own application.
    • Microsoft assesses that privileged permissions such as Directory.ReadWrite.All were likely abused, with follow-on Graph API reconnaissance and attempts to add credentials to the related service principal as a backdoor.
    • Todyl notes the consent allows read/write to mail (full mailbox via EWS), OneDrive/SharePoint, and Teams chats, including restore. Revoking user sessions does not end access; already-issued tokens stay valid up to 90 minutes. Some directory reads via Graph leave no audit trail.
    • Huntress observed a possible affinity for alphabetical targeting (victims starting with 'A').
    • AOMEI Backupper (April-July 2026): per Google Mandiant/GTIG and ManageEngine, 5-10 minute tampering windows redirected the updater to a malicious ZIP from attacker servers. It contained the CROSSROAD downloader, which uses scheduled-task persistence to deploy the SHINYROAD modular backdoor via DLL sideloading. Victims spanned IT services, telecoms and higher education in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the U.S.

    Remediation

    • Disable the ConnectWise Cloud Backup app in tenants until ConnectWise confirms all credentials are reset.
    • Enable Microsoft Graph activity logs.
    • In Entra sign-in logs (Service principal sign-ins tab), filter by AppId 506e08f9-6e9a-4da4-942b-a099a03644ae and review sign-ins from IPs outside expected Microsoft/Azure ranges; normal egress is Azure private IPv6.
    • Audit for credentials added to applications since October 13, 2026, OAuth grant changes, and ConnectWise/SkyKick apps adding themselves to directory roles.
    • Block 144.172.64[.]128 and review the listed ConnectWise Cloud Management application IDs.
22. thehackernews.com ↗ · pub. 18/10/2026 05:23 · coletado 19/10 17:53 primeiro registro

    ConnectWise application identities compromised, enabling attacker access to Microsoft 365 tenants; Cloud Backup suspended

    ler a análise desta fonte ocultar

    ConnectWise disabled seven application identities on October 17, 2026 after unknown threat actors gained unauthorized access to them and used them to compromise Microsoft 365 tenants. The company detected the issue on October 14 and has suspended Cloud Backup, SaaS Security and Cloud Management while it investigates. Huntress observed almost 1,000 Entra tenants with sign-in activity from 144.172.64[.]128, about 300 of them successful. It also reported a second, targeted wave against 16 tenants in the policy, national security, trade and critical mineral sectors, which was unsuccessful. The root cause is unknown, and ConnectWise says it is unclear whether a product vulnerability contributed to the credential exposure.

    Technical Details

    • The attacker authenticated as the ConnectWise applications and requested access tokens from Microsoft Entra ID. This gave access to mailboxes, SharePoint documents, Teams messages and directory data without stealing individual customer passwords.
    • Post-compromise actions described include adding the application to the Global Administrator role, adding client secrets to other trusted applications, and creating new applications with granted permissions. Planted secrets give persistence even after the original credential is revoked.
    • Disabled identities: ConnectWise Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae) and six Cloud Management apps (general, MS Teams, Exchange Online, MS Graph, Partner Center, SharePoint Online).
    • Huntress has high confidence the actor also targeted the Cloud Management apps for Exchange Online, Teams and SharePoint, and confirmed abuse of the Teams app in one tenant. Those apps were reportedly not disabled by ConnectWise.
    • The October 15 targeted activity included a sweep for Graph tokens from the SkyKick app (09:25-12:35 UTC) and a manual sweep (13:54-14:20 UTC) against Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra and the Office 365 Management APIs.
    • Some tenants were protected because no service principal existed, even when sign-ins succeeded.
    • Previously issued access tokens may remain valid until they expire. Revoking the connections does not reverse changes already made inside a tenant.
    • ConnectWise says existing backup archives remain encrypted and isolated, with no evidence they were accessed.

    Remediation

    • Review the partner's own tenant and every managed customer tenant, including those with dormant SkyKick connections.
    • Keep the affected applications disabled until further notice.
    • Review sign-ins from October 13, 2026 onward for activity from 144.172.64[.]128.
    • Preserve sign-in and audit logs before containment.
    • Review application credentials, federation trusts, directory roles, owners, consent grants and recent policy changes.
    • Check for unauthorized mailbox forwarding, inbox or transport rules, and delegated mailbox access.
    • Investigate any other identities changed or used during suspicious activity.
    • Use Entra application management policies to restrict client secrets and cap credential lifetimes.
    • Limit who holds the Application Administrator and Cloud Application Administrator roles.
    • Use Conditional Access for workload identities (requires extra licensing) and Entra ID Protection to flag risky service principals.