ConnectWise Supply Chain Attack Hits Microsoft 365
The ConnectWise supply chain attack now has a name behind it. Microsoft assesses that the China state-aligned group Storm-0940 used stolen credentials of ConnectWise cloud applications to sign in to customer Microsoft 365 tenants, with AI agents doing the work. Disabling the ConnectWise connection may not be enough, because the attackers could have added credentials of their own.
What Happened in the ConnectWise Supply Chain Attack
On October 21, Microsoft assessed that Storm-0940 was behind the ConnectWise supply chain attack, the compromise of ConnectWise Cloud Backup (formerly SkyKick), a multi-tenant application that customers had connected to their Microsoft 365 tenants. ConnectWise published its first advisory on October 16. As of October 23, ConnectWise said it was restoring the service in phases and asked customers to keep the connections disabled until it issues instructions. Its Trust Center has the current status.
Microsoft describes two phases. From October 10 to 14, an automated password spray from 144.172.64[.]99 hit 327 accounts at eight organizations, with more than 151,000 failed logons and a peak of 2,900 per minute on October 11. None succeeded. The same address later appears in ConnectWise’s indicators. After the application identities were compromised, the agents used them to authenticate to customer environments through apps that already had access, without an interactive user sign-in. Microsoft counts attempted sign-ins at more than 2,250 tenants.
In some environments the agents went on to Microsoft Graph: reconnaissance, application credential changes, and changes involving identities, groups and privileged roles. Microsoft says such credential changes can stay active as a backdoor after the original app is cleaned up. It also says an affected app, or even a successful sign-in, does not by itself show that data was accessed. The tool is ARTEX, an agentic AI penetration testing framework. In multiple instances, Microsoft reports less than three hours from first targeting to privileged cloud access.
Why It Matters
The customers had done what vendors ask: they granted a backup tool access. The attackers used exactly that grant, and because no user signs in, user-focused controls such as MFA usually do not come into play. Microsoft names aerospace, automotive, chemicals, energy, financial services and manufacturing among the targets, which overlaps with the German Mittelstand.
Assumption: many DACH mid-sized companies run Microsoft 365 through a managed service provider or add backup tools from vendors in this class, so “which outside apps can reach our tenant” often has no in-house answer. It is also a supply chain risk question under NIS2. We covered the vendor side in our earlier ConnectWise Cloud Backup post, and the same trust problem in the Rank Math supply chain attack.
What You Should Do Now
- Keep the ConnectWise connections disabled until ConnectWise tells you otherwise, and do not delete the enterprise apps first. Preserve configuration, Entra sign-in and audit logs, and Purview audit records. Find the apps by application ID, not display name; Microsoft lists four IDs in its report.
- Review from October 15 and, where logs allow, extend service principal sign-in review to October 1. In the Entra audit log, look for credential additions on those apps, new apps, service principals or owners, app role and consent grants, and privileged role assignments.
- Hunt the traffic. Check sign-ins and Graph activity for 144.172.64[.]99, 144.172.64[.]128 and 144.172.64[.]60, and for any app that assigned itself an administrator role. Do not limit the review to published addresses.
- After evidence is saved, have an authorized responder remove unauthorized credentials, grants and role assignments and rotate what is left. Ask your provider in writing whether your tenant was in scope.
DIESEC Perspective
Third-party app consent is the part of Microsoft 365 governance that most often has no owner. Give every app with tenant-wide permissions a named owner, a documented purpose and a review date, and treat a vendor incident as a prompt to review the credentials on the app, not only the connection.
Not sure which outside apps hold standing access to your Microsoft 365 tenant? Contact DIESEC for an enterprise application and service principal review.
Sources: Microsoft Security Blog | ConnectWise Trust Center | The Hacker News | Security Affairs
Published: 2026-10-26 | Category: Supply Chain Security | ~4 min read
