If your business runs on Microsoft 365 and your IT provider or backup tool is ConnectWise Cloud Backup, read this today. On 21 October 2026 Microsoft published research linking a ConnectWise supply chain compromise to a China-state aligned actor it tracks as Storm-0940.
According to Microsoft, the attackers used stolen application credentials to sign in to customer Microsoft 365 environments through applications those customers had already authorized. The sign-ins did not need an interactive user login. This guide explains the risk in plain language and what a small business should check. It has no attack detail.
What happened
- ConnectWise published an advisory on 16 October 2026 about attempted unauthorized access associated with Cloud Backup, and later expanded its containment guidance.
- Microsoft assesses that Storm-0940 was responsible for the compromise of a multi-tenant ConnectWise application.
- Microsoft says the actor used ARTEX, an open-source agentic AI penetration testing framework, to attempt sign-ins to more than 2,250 tenants, at up to 2,900 attempts per minute. In some environments the time from first targeting to privileged access was under three hours.
- In multiple environments Microsoft saw follow-on activity through Microsoft Graph, including reconnaissance, application credential changes and attempts to change privileges.
- TechCrunch reports ConnectWise paused access to its cloud backup system while it investigates and restores the service.
Microsoft is clear on two points. First, the activity did not come from a vulnerability in Microsoft's systems. Second, an affected app being present, or even a successful sign-in, does not necessarily mean data was accessed or stolen.
Why it matters even for small businesses
Third-party apps you authorize in Microsoft 365, such as backup, migration and management tools, can hold broad permissions. If the vendor is breached, attackers can use that trust to enter your tenant without a password or MFA prompt, because the app itself is signing in. Backdoors set up through changed app credentials can remain even after the original app is fixed.
What to do this week
Microsoft recommends these steps:
- Ask your IT provider or backup vendor whether ConnectWise Cloud Backup is connected to your Microsoft 365 tenant.
- Keep the affected ConnectWise application connections disabled until ConnectWise gives formal restoration instructions.
- Do not delete the enterprise applications first. Preserve their configuration and evidence before any irreversible change.
- Search your tenant by application ID, not display name, for the affected apps. Microsoft's post lists the IDs.
- Preserve logs. Keep Microsoft Entra sign-in and audit records and Microsoft Purview audit records.
- Review activity from at least 15 October 2026, and from 1 October where logs allow. Check successful and failed service-principal sign-ins from unfamiliar sources.
- Check Entra audit logs for application credential additions, new apps or owners, consent grants, privileged role assignments, and changes to users, groups, authentication methods or Conditional Access.
- Check mail and file activity for unusual access, downloads, forwarding rules, inbox or transport rules and delegated mailbox permissions.
- Rotate credentials and remove unauthorized access only after preserving evidence, and have an authorized responder do it if you see suspicious changes.
- Apply least privilege to every third-party app and review all app consents regularly.
This is also the week to catch up on patching. See our guides on GitLab CVE-2026-110264, the Railway secrets incident and website maintenance.
Need help reviewing your Microsoft 365 tenant, vendors and app permissions? Talk to Susraj Tech.
Frequently asked questions
Does this mean Microsoft 365 was hacked?
No. Microsoft says it was not a compromise of or vulnerability in its systems.
Should I delete the ConnectWise app?
Not first. Preserve evidence and keep connections disabled.
Sources
- Microsoft Security Blog: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
- TechCrunch: Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise
Last reviewed 22 October 2026. This is a developing story and general security information, not a guarantee of protection. Check ConnectWise's Trust Center and Microsoft's post for current guidance.
