ConnectWise Cloud Backup: Hunt Every M365 Tenant
Matthew Leo · Published October 23, 2026 · Guides
The ConnectWise Cloud Backup incident is not finished when the vendor connection is disabled. Microsoft says a China-linked group used stolen application credentials and an agentic penetration-testing tool to attempt sign-ins across more than 2,250 Microsoft 365 tenants.
ConnectWise has begun a phased restoration of Cloud Backup, formerly SkyKick, but it is telling partners to keep affected application connections disabled until service-specific reconnection instructions arrive. Existing backup archives remain encrypted, isolated and preserved, with no indication they were compromised, according to the company’s current advisory.
Those statements do not clear an individual tenant. ConnectWise and Microsoft both say partners must review their own environments and every managed customer tenant.
Why this incident crosses tenant boundaries
Microsoft attributes the activity to Storm-0940. The group used ARTEX, an open-source agentic security tool, to accelerate password spraying and activity with compromised ConnectWise application identities.
The number needs careful wording. Microsoft observed attempts to sign in to more than 2,250 tenants at peaks of roughly 2,900 attempts per minute. It did not say all those tenants were compromised. It did identify multiple customer environments where follow-on activity included Microsoft Graph reconnaissance, application-credential changes, identity changes and privileged-role changes.
A trusted multi-tenant application can hold permissions that reach mail, files, identities and directory configuration. Once its credential is stolen, user-focused controls such as a strong password or MFA may not address the application identity being abused.
First, keep the connection disabled and preserve evidence
Do not reconnect because a status page says restoration has started. ConnectWise says the process will take several days and each step is subject to security validation.
- Keep Cloud Backup, SaaS Security and Cloud Management connections disabled until ConnectWise issues instructions for the specific service.
- Preserve Microsoft Entra sign-in and audit records, Microsoft Purview Audit records, SIEM data and available Microsoft Graph telemetry.
- Record the application IDs and each tenant’s local service-principal object ID. Search by application ID, not only by a display name that can change.
- Do not delete an enterprise application as the first response. Microsoft recommends preserving its configuration and evidence before irreversible changes.
Microsoft’s technical report and hunting queries are the safest place to obtain the current application IDs and indicators. Copying a partial list into a ticket can create a false sense of completion if the vendor updates it.
Review activity, then look for persistence
Microsoft recommends reviewing activity from at least October 15, 2026, and extending service-principal sign-in review to October 1 where records are available. Successful and failed sign-ins should be examined separately.
For each current or former ConnectWise tenant integration, investigate:
- service-principal sign-ins from unfamiliar networks or outside expected vendor infrastructure;
- Microsoft Graph calls that enumerate directories, permissions, mailboxes, Teams messages, SharePoint or files;
- new application credentials, owners, service principals, consent grants or app-role assignments;
- privileged-role assignments and changes to users, groups, authentication methods or Conditional Access;
- unusual mail access, downloads, forwarding rules, delegated mailbox permissions or transport rules.
A known indicator is useful for prioritization, not as an allow-or-deny list. Microsoft explicitly says organizations should not limit their review to published IP addresses. An absence of Graph telemetry also does not prove no access occurred.
Scope each customer separately
Managed service providers should keep one central incident timeline while preserving separate evidence and decisions for every customer. Record whether the application was present, whether it authenticated, what permissions it held, which resources it accessed and whether any unauthorized changes survived the original containment.
After evidence is preserved, an authorized responder can remove confirmed unauthorized credentials, grants, owners, assignments and identities. Rotate affected secrets and verify that high-privilege application roles match an approved baseline before reconnecting.
Canadian providers also need a documented breach assessment for each organization. A vendor incident alone does not prove a reportable breach, while a successful tenant intrusion may trigger contractual, privacy, insurance and regulator-notification duties. Involve legal and privacy teams based on evidence, not the headline.
Keep backup continuity separate from identity recovery
ConnectWise says the stored backup archives have no indication of compromise, but scheduled jobs, archive access and restores have been interrupted during the suspension. Teams should document what can and cannot currently be restored, then test an alternate recovery path if business-critical data falls outside the available window.
This resembles the operational lesson in Mapletechie’s report on the AhsayCBS exploitation campaign: backup systems are both recovery tools and high-value administrative infrastructure. Their identities, permissions and logs need the same incident-response discipline as production systems.
The most important distinction is exposure versus compromise. Finding a ConnectWise application means a tenant requires review. Finding a successful sign-in means the review must pivot to activity. Finding a credential or role change means containment must include persistence, not merely disconnecting the original application.
Tags: ConnectWise, Microsoft 365, Storm-0940, cloud security, Canada