Skip to main content

Storm-0940: ConnectWise App Compromise

Attack typeSupply-chain compromise, cloud app abuse, privilege escalation, persistence
Threat actorsStorm-0940, a China state-aligned actor, and anyone holding a stolen app certificate or secret
Coverage sinceOctober 23, 2026, two days after Microsoft named the actor
PlatformsMicrosoft Entra ID, Microsoft 365

No user signed in, and no MFA prompt appeared. The attacker signed in as an app the tenant already trusted, made it Global Administrator, and planted secrets on other apps so its access would survive the vendor's cleanup.

The threat​

ConnectWise Cloud Backup (formerly SkyKick) and the ConnectWise Cloud Management apps are multi-tenant apps that MSPs use to back up and manage their customers' Microsoft 365 tenants. Each one holds admin consent in every tenant that uses it. In October 2026, an attacker got hold of the apps' credentials:

  1. October 10–14. A password spray against 327 accounts at eight organizations. Microsoft saw no successful sign-in.
  2. October 15. The attacker signed in as the apps, with no user, using the apps' own credentials. Microsoft counts attempts against more than 2,250 tenants. Huntress confirmed unauthorized sign-ins in 162 tenants by the next day.
  3. The same day. In about 50 tenants that Huntress monitors, the Cloud Management apps assigned themselves directory roles, mostly Exchange Administrator. In one tenant, the Teams management app made itself Global Administrator. Within five minutes it had added client secrets to two other apps, an MSP management app and a security vendor's app, valid until 2028.
  4. Then. Microsoft saw reconnaissance through Microsoft Graph and bulk reads of Azure Key Vault secrets. In several cases, the actor went from first targeting to privileged access in under three hours.
  5. October 17. ConnectWise disabled the apps.

On October 21, 2026, Microsoft Threat Intelligence attributed the attack to Storm-0940. It is a China state-aligned actor, active since 2021, that automated the attack with ARTEX, an open-source agentic AI penetration-testing framework. Microsoft says that adding credentials to existing apps for lasting Microsoft 365 access is a long-standing Storm-0940 technique.

Why it gets past defenses​

  • No user signs in. There is no MFA prompt, no risky sign-in and no new device, and Conditional Access policies for users never apply.
  • The app is already trusted. It was consented to long ago, so rules for new apps and new consents stay silent. A management app is expected to make admin changes.
  • App sign-ins are rarely collected. Most tenants do not keep service principal sign-ins, and Graph directory reads leave no audit record. An app that only reads leaves little or no trace.
  • Disabling the app does not end it. Secrets planted on other apps keep working after the vendor revokes its own credential.
  • It runs at machine speed. With an AI framework driving it, under three hours separated first targeting from admin rights.

How Fluency catches it​

Fluency watches what apps do in the Entra ID audit log, not only what users do.

  1. The app gives itself a role. When an app assigns any directory role to its own service principal, Fluency raises a critical alert, every time. Administrators give apps their roles. An app granting itself one is never routine, and it is the step at the center of the ConnectWise attack.
  2. The app hands out privileged access. An app that gives a user, a group or another app a privileged role, such as Global, Exchange, Privileged Role or Application Administrator, raises a high-confidence alert. A lesser role raises a medium one.
  3. The app keys other apps. When one app adds a secret or certificate to another, Fluency raises an alert, so you can remove the planted credential before it is used. Rotating the acting app's own credential leaves that one in place.
  4. Quiet on the apps that do this for a living. Access brokers and CI pipelines grant roles and rotate secrets every week. The handout and keying alerts fire the first time an app does it in 30 days, so a routine actor raises one alert, not one a week. Microsoft's own service apps, such as Privileged Identity Management, are excluded. Self-assignment gets no allowance.
  5. Every alert names the app. It carries the app's ID, the role and the target. AI Assist triages every one, so a critical app alert never waits unread in a queue.

Detections included​

DetectionWhat it catches
EntraID_App_Self_Role_AssignedAn app assigning any directory role to its own service principal. Critical, every time.
EntraID_App_Privileged_Role_AssignedAn app assigning a privileged directory role to a user or group, or any role to another app. High confidence.
EntraID_App_Role_AssignedAn app assigning a non-privileged directory role to a user or group. Medium.
EntraID_App_Credential_By_AppAn app adding a secret or certificate to another app or service principal. Medium.

MITRE ATT&CK​

TacticTechnique
Initial AccessT1199 Trusted Relationship (the vendor's multi-tenant app)
Initial Access, PersistenceT1078.004 Valid Accounts: Cloud Accounts (the stolen app credential)
Persistence, Privilege EscalationT1098.003 Additional Cloud Roles
PersistenceT1098.001 Additional Cloud Credentials

Get this coverage​

The detections are on every Fluency instance and need the Entra ID audit logs, collected through Azure Event Hubs or Microsoft Graph. To see the app sign-ins themselves, also collect service principal sign-ins through Azure Event Hubs.

The best defense pairs detection with prevention:

  • Find every vendor app in your tenant by its application ID, and check which directory roles it holds. Remove admin roles it does not need.
  • Give multi-tenant apps the least privilege they need, and review the consents you have granted to vendors.
  • Check the secrets and certificates on every app for ones you did not add.
  • If you use ConnectWise or SkyKick apps, follow the advisory, which has their application IDs and hunting steps.

Fluency watches for the attempts that still get through.

Not a customer yet? Start a free trial or book a demo.

Last updated on