Storm-0940 / ConnectWise - Stolen App Credentials at a Backup Vendor → ARTEX Agents Try 2,250+ Tenants → Graph Reconnaissance → Self-Assigned Global Admin → Key Vault Secrets
Backup software for Microsoft 365 holds standing, tenant-wide application permissions, and using them involves no user sign-in and no MFA prompt. Public reports of a compromise at ConnectWise Cloud Backup, formerly SkyKick, began on October 15, 2026, and ConnectWise reported investigating attempted unauthorized access the next day, later describing access to application identities and credentials. Microsoft assesses that Storm-0940, a China-state aligned actor active since 2021, was responsible, and that it used ARTEX, a multi-agent penetration testing framework, to attempt sign-ins to more than 2,250 tenants. Microsoft says most of the targeting failed, and also that the group achieved privileged cloud persistence at many organizations in a brief time. In multiple customer environments agents ran Microsoft Graph reconnaissance, added application credentials for persistence, changed identities and privileged roles, and read secrets across Azure Key Vaults, and one ConnectWise management application assigned itself Global Administrator. In multiple instances, initial targeting to privileged access took less than three hours. How the credentials were taken has not been made public. ConnectWise disabled seven application identities on October 17, finished resetting accounts and credentials on October 19, and began phased restoration of Microsoft 365 backups on October 28. It says backup archives show no indication of compromise and that each tenant still needs its own review.
Microsoft describes Storm-0940 as an actor focused on data theft that historically relies on password spraying and internet-facing exploits, then OAuth application abuse for persistence. None of that is new. The operator is what changed.
ARTEX is a multi-agent LLM system written in Go with a Next.js front end. Its agents run an autonomous test from reconnaissance through data exfiltration, store discovered assets and vulnerabilities in a graph, and can use any AI model. Microsoft describes it as open source, and press reports say its developer took it closed source in October after it was linked to attacks on South Korean banks. Microsoft says multiple actors in different regions use it. It dates Storm-0940's ARTEX-driven activity to as early as September 2026.
Models: any, chosen by the operator
State: assets and vulnerabilities stored in a graph
First seen here: as early as September 2026
From October 10 to 14, infrastructure at 144.172.64.99 sprayed 327 accounts across eight organizations, aimed at Microsoft 365 and Exchange Online. Microsoft counted more than 151,000 failed logons, over 111,000 of them on the peak day, reaching 2,900 failures per minute on October 11. 48 accounts took more than 1,000 failures each.
Microsoft observed no successful authentication, token issuance, Graph call or directory change from this spray. Its value to investigators came afterwards: the same address appears in ConnectWise's indicators, which helps tie the two activities together. The 2,900-per-minute figure belongs to this spray and describes failed logons only.
Scope: 327 accounts, 8 organizations
Volume: 151,000+ failed logons, peak 2,900 per minute on October 11
Outcome: no successful authentication observed
ConnectWise describes unauthorized access to application credentials associated with Cloud Backup. In its October 20 update it was still working with outside specialists to learn how that access first happened, and its advisory has published no vector through its October 30 update. Microsoft says the activity did not come from a compromise of, or a vulnerability in, its corporate systems.
A multi-tenant application is one identity consented into many tenants. Whoever holds its credential can request a token for any tenant that granted consent, with no user present. That is what makes a backup vendor an attractive target: the product needs broad access to do its job, and that access stays in place between backups.
Applications named by Microsoft: ConnectWise Cloud Backup, MS Teams and MS Graph applications, among others
Entry vector: not published
Why it worked: app-only tokens need no user, so no interactive sign-in and no MFA prompt
With the application credentials in hand, the agents authenticated to customer tenants, relying on the trust each application already held there. Microsoft's figure of more than 2,250 is a count of tenants where sign-in was attempted. It says most of the targeting was not successful and gives no number for tenants reached, reporting multiple customer environments with follow-on activity.
Microsoft warns against reading too much into a single indicator here. The presence of an affected application, or even a successful authentication, does not necessarily mean customer data was accessed or taken.
Succeeded: not published; multiple customer environments saw follow-on activity
Mechanism: existing application trust, no interactive sign-in
Caution: an affected app alone does not prove data access
In some environments the agents went past authentication into Microsoft Graph and directory operations. Microsoft calls this AI-accelerated reconnaissance, and the mapping in its report also lists cloud infrastructure discovery. Agents can work around the clock, which shortens the distance from picking a target to reaching an objective.
Also mapped: T1580 Cloud Infrastructure Discovery
Log source: MicrosoftGraphActivityLogs alongside SigninLogs
Storm-0940 added or modified credentials on existing OAuth applications to keep its access to Microsoft 365. Microsoft warns that such changes can leave a backdoor through other identities, credentials and cloud services, and that it can survive after the original application is remediated. ConnectWise rotating its own credentials says nothing about a credential the attacker added inside your tenant.
Consequence: access survives remediation of the original application
Where to look: Entra audit records: credential additions, new owners, consent grants
Microsoft lists self-assignment of Global Administrator by a ConnectWise management application among the observed techniques, and describes changes to identities, groups and privileged roles. An application able to grant itself a directory role was already holding permissions close to that level.
This is where the three-hour figure belongs. Microsoft reports multiple instances where initial targeting to privileged access took less than three hours, against a campaign in which most of the targeting failed.
Speed: under 3 hours from targeting to privileged access, in multiple instances
Defender XDR alert: Application self-assigned Global Administrator role
Microsoft reports cloud resource enumeration followed by bulk secret reads across multiple Azure Key Vaults, along with key enumeration and a key-unwrap operation. Each secret taken from a vault extends the incident beyond Microsoft 365, into whatever those secrets unlock. ConnectWise, for its part, says backup archives remain encrypted, isolated and preserved with no indication of compromise.
Also: key enumeration and a key-unwrap operation
Backup archives: no indication of compromise, per ConnectWise