ConnectWise Cloud Backup: An application identity opens Microsoft 365 tenants

Incident revealed October 15–16, 2026; Microsoft analysis October 21, ConnectWise tracking November 4. ConnectWise confirmed unauthorized access to application identities from Cloud Backup, formerly SkyKick. Microsoft attributes the campaign to Storm-0940 and describes sign-in attempts across more than 2,250 tenants. This number measures attempts, not 2,250 successful intrusions. The interesting question is how much trust is placed in a SaaS application by multiple customer organizations.

Why is an application identity enough?

A multi-tenant application is registered with its provider, then represented at each client by a service principal. The customer consents to Microsoft Graph permissions necessary for the backup service. In “app-only” authentication, the application obtains a token and acts without a user’s interactive session. The supplier must therefore protect its certificates and secrets as privileged access to all the tenants who have given their consent.

The attacker gained control of application identities related to ConnectWise. Microsoft then observes authentications from its infrastructure and, in some tenants, Graph reconnaissance calls, modifications of application identifiers and changes of roles or groups. A new credential added to another identity can keep a path after the first one is revoked. This is why cutting only the compromised certificate does not prove that the tenant has returned to its previous state.

Microsoft describes using ARTEX, an offensive automation framework using AI agents, to accelerate exploration and actions after obtaining credentials. This detail explains the cadence; it does not change the authorization mechanism. It is the permissions already granted and the stolen credentials that open the door. The password spraying campaign observed previously is distinct: Microsoft reports more than 151,000 failures, but no successful authentications in this subset.

Read logs in stages

An investigation should first inventory ConnectWise applications and their local Object ID, then search for service principal sign-ins. We then correlate the time, IP and application ID with the Graph calls: directory reading, credential addition, role assignment and resource access. Finally, we search for secondary identities created or modified. The Microsoft publication provides hunting queries and affected application IDs. The presence of the application, and even successful authentication, do not alone demonstrate data exfiltration.

ConnectWise has disabled identities and revoked associated certificates, suspending Cloud Backup and related services. The supplier specifies that existing backup archives remain encrypted and isolated, with no indication of compromise of these archives; This doesn’t answer the question of what activity there might be in each customer’s live Microsoft 365 environment. As of November 4, restoration and re-enrollment are still progressing in stages. Administrators should follow the provider’s recovery guidelines and check their tenant and those they manage separately.

Primary sources: ConnectWise advisories and timeline, Microsoft analysis and queries.