Microsoft ties ConnectWise backup abuse to Storm-0940 and ARTEX
Sign-in attempts hit 2,900 a minute, with more than 111,000 failures on October 11 alone.
82
Product
Cloud Backup
- Mentions · 7d8
- Mentions · 30d8
- All mentions8
- First seenOct 19, 2026
- Last mentioned3d ago
Timeline
8 articles · newest firstMicrosoft says Storm-0940 used AI to breach ConnectWise tenants
The group attempted more than 2,250 tenant sign-ins at about 2,900 per minute, often gaining access within three hours.
82
ConnectWise resets Cloud Backup credentials after unauthorized access
Huntress saw vendor-credential sign-ins from 144.172.64.128, then Global Administrator grants and new secrets on two tenants.
78
ConnectWise suspends Cloud Backup after attackers abuse Microsoft 365 access
Huntress saw the stolen app credential sign into at least 162 Microsoft 365 tenants on October 15; earlier tokens may still work.
78
ConnectWise suspends cloud services after M365 tenant access
Huntress says a Cloud Backup client assertion reached 162 Microsoft 365 tenants on October 15–16.
78
ConnectWise backup credential used to enter Microsoft 365 tenants
Huntress reported suspicious sign-ins across 162 organizations; ConnectWise disabled seven app identities and three cloud services.
76
Stolen ConnectWise app credentials used against Microsoft 365 tenants
Seven application identities were disabled and Cloud Backup suspended; Huntress saw about 300 successful sign-ins.
78
ConnectWise suspends Cloud Backup after unauthorized app-identity access
Huntress says a stolen Cloud Backup Microsoft 365 API secret was used in customer tenants.
78
Appears with
- Microsoft 365product · 7
- Cloud Managementproduct · 7
- ConnectWisevendor · 7
- Huntressorganization · 6
- SaaS Securityproduct · 6
- Microsoftvendor · 6
- ConnectWisevictim · 2
- Microsoft Entra IDproduct · 2
- ARTEXmalware · 2
- Storm-0940threat actor · 2
- SkyKickproduct · 2
- Zscalerorganization · 1
- Exchange Onlineproduct · 1
- CrowdStrikeorganization · 1
- Microsoftorganization · 1
- Google Workspaceproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.