A week after ConnectWise pulled Cloud Backup offline, Microsoft has put a name and a speed on it. Microsoft Threat Intelligence assesses that Storm-0940, a China state-aligned group it has tracked since 2021, was behind the ConnectWise supply chain compromise. After getting hold of the identities of multiple ConnectWise cloud applications, the group used ARTEX, an open-source agentic AI pentest framework, to try signing in to more than 2,250 tenants at a peak of 2,900 attempts a minute (Microsoft).
Read the numbers carefully. 2,250 is tenants targeted, not tenants breached. Microsoft says most of the targeting failed, but the group still got privileged cloud persistence at “many organizations” in a short window, in some cases under three hours from first targeting to privileged access. Responders had already counted unauthorized sign-ins in at least 162 tenants as of Oct 16 (per Kudelski Security). Confirmed data theft per tenant: Undisclosed. Microsoft is explicit that a successful app sign-in doesn’t on its own prove mail or files were taken.
Why it worked. No phishing and no MFA prompt. Backup apps hold admin-consented Graph permissions in every customer tenant, so with the vendor’s app credentials the agents authenticated as a service principal the tenant already trusted. In some tenants they kept going through Microsoft Graph: directory recon, new credentials added to other app registrations, and changes to groups and privileged roles. One of the ConnectWise apps assigned itself Global Administrator. Microsoft warns those added credentials can stay live as a backdoor after the original app is cleaned up (Microsoft).
Same crew, earlier noise. Between Oct 10 and 14, the same 144.172.64[.]99 address ran a cross-tenant password spray at 327 accounts across eight organizations: 151,000+ failed logons, peaking at 2,900 failures a minute on Oct 11, with no successful sign-in. The ConnectWise IOCs published Oct 16 matched that range (Microsoft). ConnectWise’s Oct 22 13:00 UTC update says phased restoration is still running and per-service reconnection instructions are still coming (ConnectWise).
What I’d do this morning. Search Entra by app ID, not display name: 506e08f9-6e9a-4da4-942b-a099a03644ae (Cloud Backup), 24205314-2b89-4e07-a2a4-579e898a5640 (MS Teams) and 0de14c77-b9b0-4137-9360-34878a929827 (MS Graph). Check old tenants and integrations you thought you’d retired, too. Pull service principal sign-ins back to Oct 1, then audit every credential added to any app registration, every new owner, consent grant and role assignment since Oct 15. Hunt 144.172.64[.]60/.99/.128 and the python-requests, Python-urllib, curl/7.88.1 and azure-toolkit/1.0 user agents in Graph activity logs. Microsoft’s advice is to keep the ConnectWise connections disabled, and don’t delete the enterprise app before you’ve preserved its config and logs.
The buyer read. This is the first big public case of agentic AI turning one vendor credential into a multi-tenant sweep, and it lands on an MSP platform in the middle of a week when partners are already reworking their stacks. Every SaaS backup, email security and M365 management tool in your tenant holds the same kind of standing app-only access. Ask each of those vendors this quarter how they store and rotate their multi-tenant app secrets, and whether they’ll move to certificate or federated credentials. Then cut every app-only permission you can’t justify. The time to detect here was minutes, so automated containment on service principal anomalies is no longer optional.