ConnectWise said on October 22, 2026, that testing and security validation for Cloud Backup restoration were still progressing. It expected access to backup restoration early the following week only if validation succeeded, and told partners to keep affected connections disabled until they received service-specific instructions.
ConnectWise’s recovery plan was still conditional on October 22
ConnectWise’s updates moved from containment toward a staged recovery, but the October 22 milestone remained conditional on security checks. The company had said it identified unauthorized access to Cloud Backup application identities on October 17, shut off application access, and completed a reset of accounts and credentials in the affected environment on October 19.
| Date | ConnectWise update | Recovery status |
| October 16, 2026 | Issued an initial advisory about attempted unauthorized access associated with Cloud Backup. | Investigation and containment were underway. |
| October 17, 2026 | Said it had identified unauthorized access to Cloud Backup application identities and shut off application access. | Access to the affected applications was disabled. |
| October 19, 2026 | Said it had completed a full reset of accounts and credentials in the affected environment. | The reset was complete. |
| October 21, 2026 | Said controlled, phased restoration had begun, subject to security validation. | Restoration was in progress. |
| October 22, 2026 | Said restoration testing and security validation were progressing. | Access to backup restoration was anticipated early the following week if validation succeeded; partners were to wait for service-specific instructions before reconnecting affected applications. |
ConnectWise also said it had no indication that its encrypted, isolated backup archives had been accessed. The company separately said customer Microsoft 365 environments required individual review. ConnectWise’s incident updates describe the archive status and recovery instructions.
How application identities provided a route into Microsoft 365
On October 21, Microsoft attributed the campaign to Storm-0940, which it describes as China-state-aligned. Microsoft said the group had used ARTEX, an open-source framework that coordinates AI agents for penetration-testing workflows, as early as September 2026.
Microsoft said Storm-0940 gained control of ConnectWise cloud application identities and used applications that already had access in customer environments. Those identities could authenticate without an employee signing in interactively. Microsoft reported attempted sign-ins to more than 2,250 Microsoft 365 tenants, followed by Graph reconnaissance and directory activity in multiple customer environments. The activity included application-credential changes and attempted changes involving identities, groups, and privileged roles.
Microsoft also reported multiple ARTEX-driven attacks in which the actor obtained privileged cloud access in under three hours from initial targeting. ConnectWise’s application identities were the route described in this campaign; the October password-spray activity below was a separate set of events.
Microsoft reported two distinct activity sets
From October 10 through 14, 2026, Microsoft observed more than 151,000 failed logon events against 327 accounts at eight organizations. In that password-spray set, Microsoft observed no successful authentication, token issuance, Microsoft Graph call, or directory change. The activity peaked at 2,900 failures per minute on October 11.
Separately, Microsoft reported attempted sign-ins to more than 2,250 tenants through ConnectWise application identities, as well as follow-on activity in multiple customer environments. The failed-logon count describes the October 10–14 spray set; it does not describe the outcome of the separate application-identity activity. Microsoft’s report gives the campaign findings and administrator guidance in its Storm-0940 incident report.
What Microsoft recommended administrators review
Microsoft recommended that administrators keep affected ConnectWise connections disabled until formal restoration instructions arrive. It advised against deleting enterprise applications as a first response, and recommended searching by application ID rather than display name.
ConnectWise identified the Cloud Backup application ID 506e08f9-6e9a-4da4-942b-a099a03644ae for review in Microsoft Entra service-principal sign-in logs. Microsoft recommended preserving Entra sign-in and audit records, Microsoft Purview Audit records, SIEM data, and available Microsoft Graph telemetry. It advised reviewing activity from at least October 15 and extending service-principal sign-in review to October 1 where records are available.
Administrators should examine unexpected application credentials, newly added applications or owners, consent grants, role assignments, changes to users or groups, and unusual mail or file access. Microsoft notes that credential changes can remain active after the original application is remediated, so its guidance also calls for reviewing activity after sign-in and correlating it with subsequent Graph operations, directory changes, and resource access.
