ConnectWise Cloud Backup shut down after M365 app-identity hijack
› ConnectWise Cloud Backup / Microsoft 365 app identity
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- Oct 17, 2026
- closed
- ongoing
- CVEs
- none
- sources
- 3
## summary
ConnectWise disabled Cloud Backup after a compromised credential let attackers authenticate as the application and sign in to at least 173 customer Microsoft 365 tenants.
severity: Critical SaaS / identity compromise
## affected
- Cloud Backup service (shut down)
## fixed in
no fixed release yet
## timeline[2]
Microsoft details Storm-0940's Oct 10-14 password spray (151,000+ failed logons, peak 2,900/min) before the Oct 15 takeover of ConnectWise cloud app identities; ConnectWise says phased service restoration will take several days.
sourceMicrosoft attributes the ConnectWise supply-chain compromise to China-aligned Storm-0940, using the agentic AI framework ARTEX; 2,250+ Microsoft 365 tenants targeted.
source
## news & write-ups[3]
- Cyberbreaches: ConnectWise Cloud BackupCyberbreaches · Oct 17, 2026
- Microsoft Security Blog: Storm-0940 uses ARTEX agentic AI in ConnectWise supply-chain compromiseMicrosoft Threat Intelligence · Oct 21, 2026 · write-up
- China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain AttackThe Hacker News · Oct 22, 2026
## notes & caveats
Verify primary vendor advisory for exact fixed versions; facts taken from public sources listed in links.
