What happened
Between October 10 and October 14, 2026, Microsoft says Storm-0940 infrastructure at 144.172.64.99 ran an automated cross-tenant password spray against 327 accounts at eight organisations. The broader operation attempted sign-ins at more than 2,250 Microsoft 365 tenants, and Microsoft reported some cases reaching privileged cloud access in under three hours. ConnectWise says it discovered the incident on October 14, 2026 and initiated internal and external response actions. Since mitigations began on October 17, 2026 at 05:00 UTC, ConnectWise says it has not observed successful threat activity in the environments it monitors.
On October 23, 2026, ConnectWise said restoration required phased re-enrolment and partner verification while Cloud Backup, SaaS Security and Cloud Management remained constrained. Cloud Backup jobs, archive access and restores were not currently accessible, alongside SaaS Security monitoring and Cloud Management administration. ConnectWise says existing backup archives remain encrypted, isolated and preserved, with no indication of compromise. That statement applies to stored archives; ConnectWise continues to require review of individual partner and customer Microsoft 365 environments.
ConnectWise published source IP 144.172.64.128 and user agents Python-urllib/3.12 and python-requests/2.31 for monitoring. The cited sources do not publish a confirmed count of compromised partner or customer tenants. Attribution posture: ConnectWise and Microsoft attribute the activity to China state-aligned actor Storm-0940. The named framework is ARTEX, an openly available agentic AI penetration-testing framework. The cited sources do not identify ARTEX’s underlying model or version. Microsoft says the operator configured ARTEX to automate enumeration and sign-in activity across Microsoft 365 tenants. Mechanically, ARTEX accelerated password spraying and cloud-access steps under operator direction. The cited source did not publish the underlying model detail described as ARTEX underlying model.
Why this matters now
The trusted application relationship, rather than an end-user password, created the material exposure. A compromised multi-tenant application identity can authenticate across customer environments, exercise delegated permissions and bypass controls designed around interactive users. MSPs therefore need to treat application registrations, service principals, credentials and consent grants as privileged identity infrastructure rather than ordinary vendor configuration.
Availability and compromise are now separate workstreams. ConnectWise can safely restore Cloud Backup while an individual customer tenant still contains an unauthorised credential, consent grant, mailbox rule or privileged assignment created before containment. Conversely, a tenant may be clean while remaining exposed to recovery risk because scheduled backups, archive access or restores were unavailable. Monday governance must track both conditions independently.
The incident also tests the managed-service operating model. Resellers and MSPs need evidence for every connected tenant, not a statement that the provider’s monitored environment shows no further activity. Where log retention, customer administrator access or contractual authority is incomplete, leadership needs an explicit exception rather than an assumed clean result.
The decision for security leaders
Make tenant assurance a formal incident workstream independent of ConnectWise service recovery. The owner should maintain a tenant-level disposition covering successful and failed application sign-ins, credential changes, consent grants, role assignments, mailbox activity and evidence limitations.
Require the MSP or internal service owner to prove which application identities, permissions and secrets existed before the incident and what has been replaced. A vendor statement that containment holds in its environment cannot close identity paths already established in a customer tenant.
Treat backup continuity as an executive resilience decision. Where backup jobs or restores remain unavailable, document workload-specific recovery alternatives, maximum tolerable data loss and the point at which customer or regulatory communication becomes necessary.
Evidence of closure
- A tenant-by-tenant review shows no unauthorised application sign-ins, consent changes or privileged role assignments.
- All affected application credentials and permissions are reissued from known-clean administrative accounts.
- A tested restore demonstrates current recoverability after service re-enrolment.
- Exceptions identify tenants lacking logs, retention or administrator access, with signed risk acceptance.
The Security.io assessment
The provider’s archive statement is relevant but narrow. It reduces concern that stored backup repositories were directly accessed; it does not establish that live Microsoft 365 tenants, delegated application permissions or downstream administrator identities remained untouched. Service restoration must therefore be recorded as an availability milestone rather than incident closure.
The Microsoft evidence materially strengthens the campaign assessment: it identifies the actor cluster, the ARTEX framework, campaign infrastructure, targeting quantities and the speed at which some operations reached privilege. Confidence is high that the activity was coordinated and automated, but the impact to any specific ConnectWise partner still depends on local logs and tenant evidence.
The most consequential Monday risk is an evidence gap. Tenants with short audit retention, incomplete application inventories or unclear administrative ownership may be unable to prove a negative. Those cases should remain open with explicit limitations rather than being marked clean by default.
Questions for the morning meeting
- Which executive owns the tenant-by-tenant assurance decision across every managed customer?
- Can the organisation restore Microsoft 365 data without the suspended ConnectWise capabilities?
- Which tenants lack sufficient Entra audit retention to support a defensible compromise assessment?