{"id":"CMP-202610-stolen-connectwise-cloud-backup-skykick-app-credential-used-","kind":"campaign","aliases":[],"related":[],"title":"Stolen ConnectWise Cloud Backup (SkyKick) app credential used to break into Microsoft 365 tenants","description":null,"summary":"A Microsoft 365 application secret belonging to ConnectWise Cloud Backup (formerly SkyKick Backup) was compromised and, from about 2026-10-14, used to request app-only Microsoft Graph tokens from customer tenants that had consented to the app; no user password or MFA is needed. On 2026-10-15 the credential was swept across almost 1,000 tenants (user agent Python-urllib/3.12). In some tenants the actor added secrets and certificates to applications, granted itself Global Administrator, and added credentials to other apps (via ConnectWise Cloud Management apps for Exchange Online, Teams, SharePoint, Graph and Partner Center). Microsoft attributes it to Storm-0940 using the ARTEX AI agent framework; Huntress and Sophos confirm the activity. Any organisation or MSP using ConnectWise Cloud Backup / SkyKick for M365 is at risk. How the credential was stolen and what data was taken are unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-26T21:02:41+00:00","products":[{"name":"ConnectWise Cloud Backup","fixed":[],"affected":"M365 tenants with the app consented","ecosystem":"vendor"},{"name":"SkyKick Backup","fixed":[],"affected":"M365 tenants with the app consented","ecosystem":"vendor"},{"name":"Microsoft 365","fixed":[],"affected":"tenants consented to ConnectWise Cloud Backup / Cloud Management apps","ecosystem":"vendor"},{"name":"Microsoft Entra ID","fixed":[],"affected":"tenants consented to ConnectWise Cloud Backup / Cloud Management apps","ecosystem":"vendor"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"- In Entra Admin Center > Enterprise Applications (clear filters), search for Application ID 506e08f9... / \"SkyKick\" / \"ConnectWise Cloud Backup\" and the ConnectWise Cloud Management apps (MS Teams app ID 24205314-2b89-4e07-a2a4-579e898a5640).\n- Review Monitoring > Sign-in logs > Service principal sign-ins for these app IDs from 2026-10-14 on, including Python-urllib/3.12 user agents.\n- Check the directory audit log for new secrets or certificates on any application, Global Administrator role grants to service principals, and deleted service principals.","fix":"- If you do not need it, remove consent for ConnectWise Cloud Backup / SkyKick and ConnectWise Cloud Management apps; otherwise follow ConnectWise guidance on rotated credentials (status unknown from sources).\n- Remove any credentials added to applications and any role grants you did not make; rotate secrets on apps that were touched.\n- Enable Microsoft Graph activity logging so future Graph reads are visible.\n- Review other third-party multi-tenant apps with broad Graph permissions.","status":"open","published_at":"2026-10-16T00:00:00+00:00","first_seen_at":"2026-10-26T21:02:41+00:00","triaged_at":"2026-10-26T21:02:41+00:00","updated_at":"2026-10-26T21:02:41+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-0940':27A,150B '-10':64B,93B '-14':65B '-15':94B '-202610':16A '/3.12':109B '000':102B '1':101B '2026':63B,92B '365':13A,37A,47B 'abuse':30A 'across':99B 'activ':162B 'actor':114B 'add':115B,126B 'administr':124B 'agent':105B,155B 'ai':154B 'almost':100B 'app':6A,23A,70B,83B,130B,135B 'app-on':69B 'applic':48B,120B 'artex':153B 'attribut':146B 'backup':4A,21A,33A,35A,54B,57B,170B 'belong':50B 'break':10A 'campaign':41B 'center':144B 'certif':118B 'cloud':3A,20A,32A,53B,133B,169B 'cmp':15A 'compromis':59B 'confirm':160B 'connectwis':2A,52B,132B,168B 'connectwise':19A,31A 'consent':80B 'credenti':7A,96B,127B,179B 'credential':24A,29A 'custom':76B 'data':184B 'earli':43B 'early-warn':42B 'entra':39A 'exchang':137B 'former':55B 'framework':156B 'global':123B 'grant':121B 'graph':73B,141B 'huntress':157B 'id':40A 'm365':173B 'manag':134B 'mfa':88B 'microsoft':12A,36A,38A,46B,72B,145B 'msp':166B 'need':90B 'onlin':138B 'organis':164B 'partner':143B 'password':86B 'python':107B 'python-urllib':106B 'request':68B 'risk':176B 'secret':49B,116B 'sharepoint':140B 'skykick':5A,22A,28A,34A,56B,171B 'sopho':159B 'stolen':1A,18A,181B 'stolen-connectwise-cloud-backup-skykick-app-credential-used':17A 'storm':26A,149B 'swept':98B 'taken':186B 'team':139B 'tenant':14A,77B,103B,112B 'token':74B 'unknown':188B 'urllib':108B 'use':8A,66B,151B,167B 'used':25A 'user':85B,104B 'via':131B 'warn':44B","nicknames":["Storm-0940","SkyKick credential abuse"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-stolen-connectwise-cloud-backup-skykick-app-credential-used-","url":null,"severity":null,"published_at":"2026-10-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-26T21:02:41+00:00","fetched_at":"2026-10-26T21:02:41+00:00","note":null}],"documents":[{"id":4152,"url":"https://x.com/HuntressLabs/status/2114802748885442791","title":"@HuntressLabs: On October 16, we reported the abuse of a ConnectWise Cloud Backup credential to","kind":"post","source":"x","text":"On October 16, we reported the abuse of a ConnectWise Cloud Backup credential to access Microsoft 365 tenants. Since then, we’ve been asking a new question: who, or what, was doing the typing? 🤖\n\n🔗 Read our blog for our working hypothesis: https://t.co/Cc8o4rd9e2 https://t.co/gRhdvgb3qM\n\nlikes 28 reposts 4","published_at":"2026-10-26T19:34:01+00:00","relation":"describes","confidence":null,"note":null},{"id":4343,"url":"https://www.huntress.com/blog/connectwise-attack-ai","title":"Huntress: AI, Scripts, Operator: Inside the ConnectWise Attack","kind":"blog","source":"blog","text":"AI, Scripts, Operator: Inside the ConnectWise Attack\n\nMicrosoft says an AI agent drove the ConnectWise attack. Huntress telemetry is consistent with that: scripted tooling, steered by an operator.","published_at":"2026-10-26T19:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":4396,"url":"https://support.huntress.io/hc/en-us/articles/56492265597459-2026-October-SkyKick","title":"Huntress: 2026 - October SkyKick (ConnectWise Cloud Backup credential compromise)","kind":"vendor","source":"analyst","text":"Huntress confirmed a ConnectWise Cloud Backup (formerly SkyKick Backup) M365 application credential was compromised and used from about 2026-10-14 to obtain Microsoft Graph tokens across customer tenants. Check Entra Admin Center > Enterprise Applications for Application ID 506e08f9 (SkyKick / ConnectWise Cloud Backup); review Service principal sign-ins for that app ID. Related: ConnectWise Cloud Management - MS Teams app 24205314-2b89-4e07-a2a4-579e898a5640 granted itself Global Administrator and added credentials to other apps in one tenant (Huntress blog 2026-10-17). Sophos X-Ops saw a 96-minute scripted cross-tenant token sweep from one VPS on 2026-10-15. Microsoft attributes to Storm-0940 using ARTEX AI agent framework.","published_at":"2026-10-21T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":2434,"url":"https://x.com/wiz_io/status/2113284193975255255","title":"@wiz_io: 🚨Wiz Research is tracking Storm-0940, an ARTEX-using actor, as it Expands its ta","kind":"post","source":"x","text":"🚨Wiz Research is tracking Storm-0940, an ARTEX-using actor, as it Expands its targeting of IT and Software Vendors. Learn how the AI agent attacks Okta, Entra, and Cognito, and what it left behind in the logs.\nhttps://t.co/hDg8aJRHDG\n\nlikes 44 reposts 5","published_at":"2026-10-22T14:59:49+00:00","relation":"discussion","confidence":null,"note":"@wiz_io"},{"id":4212,"url":"https://x.com/MsftSecIntel/status/2113005667363573823","title":"@MsftSecIntel: Microsoft Threat Intelligence assesses that China state-aligned threat actor Sto","kind":"post","source":"x","text":"Microsoft Threat Intelligence assesses that China state-aligned threat actor Storm-0940 was responsible for this supply chain compromise. Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a\n\nlikes 11 reposts 1","published_at":"2026-10-21T20:33:03+00:00","relation":"discussion","confidence":null,"note":"@MsftSecIntel"},{"id":4213,"url":"https://x.com/MsftSecIntel/status/2112975078266716390","title":"@MsftSecIntel: The China state-aligned threat actor Storm-0940 used the agentic AI penetration ","kind":"post","source":"x","text":"The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Microsoft Threat Intelligence assesses that Storm-0940 was responsible for\n\nlikes 4394 reposts 1050","published_at":"2026-10-21T18:31:30+00:00","relation":"discussion","confidence":null,"note":"@MsftSecIntel"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}