Advisory: ConnectWise App Compromise (Storm-0940)

An attacker stole the credentials of ConnectWise's multi-tenant Cloud Backup (formerly SkyKick) and Cloud Management apps. It then signed in to customers' Microsoft 365 tenants as those apps, with no user and no MFA. Microsoft attributed the attack on October 21, 2026 to Storm-0940, a China state-aligned actor that automated it with an AI penetration-testing framework. Microsoft counts attempts against more than 2,250 tenants. In several cases, the actor went from first targeting to privileged access in under three hours.

Any tenant that consented to one of these apps should be checked for changes the attacker made. MSPs use the apps widely, so MSSPs should check every tenant they manage. Every other tenant runs the same kind of risk through the vendor apps it trusts. On October 23, 2026, Fluency released four detections to every instance for an app that hands out directory roles or keys other apps. No action is needed to turn them on.

The playbook

• Password spraying first. From October 10 to 14, the actor sprayed 327 accounts at eight organizations, at up to 2,900 failed attempts a minute. Microsoft saw no successful sign-in in this phase.
• Signing in as the vendor's app. On October 15, the actor signed in as the ConnectWise apps using the apps' own credentials. The apps already held admin consent in each tenant, so no user, MFA prompt or new consent was involved. Huntress confirmed unauthorized sign-ins in 162 tenants by the next day.
• Admin roles the app gives itself. In about 50 tenants that Huntress monitors, the Cloud Management apps assigned themselves directory roles, mostly Exchange Administrator. In one tenant, the Teams management app made itself Global Administrator.
• Secrets planted on other apps. Within five minutes, that app ran a Python script that added client secrets to two other apps in the tenant, an MSP management app and a security vendor's app, valid until 2028. Disabling the ConnectWise apps does not remove those secrets.
• Reconnaissance and secrets. Microsoft saw reconnaissance through Microsoft Graph and bulk reads of secrets from Azure Key Vault.

ConnectWise disabled the apps on October 17.

Why it is hard to catch

• No user signs in. There is no MFA prompt, no risky sign-in and no new device for user-based rules to see.
• The app is already trusted. It was consented to long ago, so rules for new apps and new consents do not fire.
• App sign-ins are rarely collected. Most tenants do not keep service principal sign-ins, and Graph directory reads leave no audit record. An app that only reads leaves little or no trace.
• What does show is in the audit log: a service principal assigning roles, often to itself, and adding secrets to other apps.

Fluency's new detections

Detection	Fires when	Alerts
EntraID_App_Self_Role_Assigned	An app assigns any directory role to its own service principal.	Critical, every time
EntraID_App_Privileged_Role_Assigned	An app assigns a privileged directory role (Global, Exchange, Privileged Role or Application Administrator and the like) to a user or group, or any role to another service principal.	High confidence, first time per app in 30 days
EntraID_App_Role_Assigned	An app assigns a non-privileged directory role to a user or group.	Medium, first time per app in 30 days
EntraID_App_Credential_By_App	An app adds a secret or certificate to another app or service principal.	Medium, first time per app in 30 days

All four read the Entra ID audit logs, collected by Entra ID Audit via Event Hubs or Microsoft Graph. Access brokers and CI pipelines do some of these things as their job, so the first-time rules raise one alert per app, not one a week. They start alerting about a week after reaching a tenant. Self-assignment is never routine and alerts from the start. For activity before October 23, hunt as described below.

What we recommend

For every organization

1. Find the ConnectWise apps by application ID, not by name. In older tenants the Cloud Management apps can appear as "SkyKick Cloud Manager". Huntress lists these IDs:

   Application	Application ID
   ConnectWise Cloud Backup	506e08f9-6e9a-4da4-942b-a099a03644ae
   ConnectWise Cloud Management	2399d300-6fca-4e6a-a686-399fefe75b83
   ConnectWise Cloud Management - MS Teams	24205314-2b89-4e07-a2a4-579e898a5640
   ConnectWise Cloud Management - Exchange Online	b78f6a77-d4e5-46fb-87e5-d1648bd02519
   ConnectWise Cloud Management - MS Graph	0de14c77-b9b0-4137-9360-34878a929827
   ConnectWise Cloud Management - Partner Center	412dcf96-176d-4b3a-a1b0-4981ad66971e
   ConnectWise Cloud Management - SharePoint Online	b2b55f5b-7758-4719-8d8f-88ae172e6bdb

2. Disable the apps, don't delete them, until ConnectWise confirms they are safe. Deleting an app removes its consent and the evidence of what it held.

3. Look for credentials you did not add. Check the secrets and certificates on every enterprise application and app registration added since October 13, especially on management and security tools. Remove any you did not create.

4. Check which directory roles vendor apps hold. Remove Global Administrator, Exchange Administrator or Privileged Authentication Administrator from any app that does not need it.

5. Collect service principal sign-ins. Select the ServicePrincipalSignInLogs category in the Entra ID diagnostic setting that feeds Entra ID Audit via Event Hubs. Without it, an app signing in with a stolen credential leaves no record. The Microsoft Graph template collects interactive sign-ins only.

6. Give multi-tenant apps the least privilege they need, and review the consents you have granted to vendors.

For MSSP partners

• Check every client tenant, and your own. Include tenants where the apps were authorized but are no longer used. Check your MSP management tools too: in the tenant Huntress described in detail, one of the two apps the attacker keyed was an MSP management app.
• Hunt from October 15. Look for sign-ins as the app IDs above (from October 1 where service principal sign-ins are kept), roles assigned by those apps, and credentials they added to other apps. Microsoft and ConnectWise published source IP addresses in 144.172.64.0/24, but don't limit the search to them.
• Check coverage. Confirm which clients send Entra ID audit logs, and which also send service principal sign-ins. Clients that send only the Microsoft 365 unified audit log get no coverage from the new detections yet.
• Act fast when it fires. For a self-assigned role, remove the role, disable the service principal and remove its credentials, unless the vendor confirms the change. Then review what the app did next: other role grants, credentials added to other apps, password resets and mail access.

If you find a match, raise a support ticket and Fluency will help with the investigation. Each rule's full match conditions, what it does not cover yet, and triage steps are in the Entra ID App Identity Detections release notes.

References

• Microsoft Threat Intelligence, AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (Storm-0940), October 21, 2026.
• Huntress, ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks, October 16, 2026, updated October 19, 2026.

Splash Summary

An attacker stole the credentials of ConnectWise's multi-tenant Cloud Backup (formerly SkyKick) and Cloud Management apps. It then signed in to customers' Microsoft 365 tenants as those apps, with no user and no MFA. Microsoft attributed the attack on October 21, 2026 to Storm-0940, a China state-aligned actor, and counts attempts against more than 2,250 tenants.

Any tenant that consented to one of these apps should be checked for changes the attacker made, and MSSPs should check every tenant they manage. On October 23, 2026, Fluency released four detections to every instance for an app that hands out directory roles or keys other apps. No action is needed to turn them on.