Microsoft says Storm-0940 used AI to breach ConnectWise tenants
The group attempted more than 2,250 tenant sign-ins at about 2,900 per minute, often gaining access within three hours.
82
Product
Cloud Management
- Mentions · 7d10
- Mentions · 30d10
- All mentions10
- First seenOct 19, 2026
- Last mentioned3d ago
Timeline
10 articles · newest firstConnectWise resets Cloud Backup credentials after unauthorized access
Huntress saw vendor-credential sign-ins from 144.172.64.128, then Global Administrator grants and new secrets on two tenants.
78
ConnectWise suspends Cloud Backup after supply-chain credential attack
Huntress saw unauthorized sign-ins in 162 Microsoft 365 tenants after attackers used the backup app’s permissions.
78
ConnectWise disables Cloud Backup after Microsoft 365 logins
Researchers say ConnectWise credentials signed into customer Microsoft 365 tenants; downstream impact is unconfirmed.
74
ConnectWise suspends Cloud Backup after attackers abuse Microsoft 365 access
Huntress saw the stolen app credential sign into at least 162 Microsoft 365 tenants on October 15; earlier tokens may still work.
78
ConnectWise suspends cloud services after M365 tenant access
Huntress says a Cloud Backup client assertion reached 162 Microsoft 365 tenants on October 15–16.
78
ConnectWise backup credential used to enter Microsoft 365 tenants
Huntress reported suspicious sign-ins across 162 organizations; ConnectWise disabled seven app identities and three cloud services.
76
ConnectWise takes cloud services offline after Microsoft 365 access
Unauthorized access to Cloud Backup application identities was found after October 15; restoration timing and any data theft remain unconfirmed.
78
Stolen ConnectWise app credentials used against Microsoft 365 tenants
Seven application identities were disabled and Cloud Backup suspended; Huntress saw about 300 successful sign-ins.
78
ConnectWise suspends Cloud Backup after unauthorized app-identity access
Huntress says a stolen Cloud Backup Microsoft 365 API secret was used in customer tenants.
78
Appears with
- Microsoftvendor · 9
- SaaS Securityproduct · 9
- Microsoft 365product · 9
- ConnectWisevendor · 9
- Huntressorganization · 8
- Cloud Backupproduct · 7
- ConnectWise Cloud Backupproduct · 3
- Microsoft Entra IDproduct · 2
- ConnectWisevictim · 2
- SkyKickproduct · 2
- CoreVieworganization · 1
- Exchange Onlineproduct · 1
- ARTEXmalware · 1
- SpecterOpsorganization · 1
- CrowdStrikeorganization · 1
- Storm-0940threat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.