The call
On 21 October at 18:23 UTC Microsoft attributed the ConnectWise Cloud Backup supply chain compromise to Storm-0940, a China-state aligned group, and said the group ran ARTEX, an open-source agentic penetration testing framework, against hundreds of organisations from as early as September (vendor, Microsoft Security). ConnectWise’s chief executive, Manny Rivelo, said the evidence points to a China state-aligned group, and that containment on ConnectWise’s side does not remove access that may already exist in customer tenants (vendor, via Reuters on Rappler). Microsoft says some ARTEX-driven attacks reached privileged cloud access in under three hours (vendor).
What it is, and what it is not
What it is. A stolen vendor identity, used at machine speed. Cloud Backup, formerly SkyKick, is a backup app for managed service providers with broad consented access to mailboxes, OneDrive, SharePoint, Teams, and directory data in every tenant that installed it (independent, The Hacker News). On 15 October, between 06:13 and 08:34 UTC, the attacker used the app’s credential to obtain Graph tokens in customer tenants, moving through them in sorted order a few seconds apart; Huntress confirmed unauthorised sign-ins in 173 tenants (independent, The Hacker News). In some tenants a separate ConnectWise app added itself to Global Administrator and planted new secrets on other apps, valid until 2028 (independent, Help Net Security). ConnectWise disabled seven application identities on 17 October and suspended Cloud Backup, SaaS Security, and Cloud Management (vendor, via Help Net Security).
What it is not. It is not a Microsoft vulnerability; Microsoft says its own systems were not compromised (vendor). It is not a Salesforce incident: nothing published names Salesforce. And it is not proof of data theft. A successful sign-in does not mean data was read (vendor, Microsoft), but Huntress warns that some Graph directory reads leave no audit trail, so absence of evidence is weak here (independent, The Hacker News). It is also not an MFA story. Application credentials do not do MFA. That is the point.
The number nobody is quoting
Coverage leads with 2,250 tenants and an AI tool. The number a buyer needs is the gap between the front door and the side door.
| Measure | Figure | Label |
|---|---|---|
| Password spray, 10 to 14 Oct: failed logons against 327 accounts at eight organisations | 151,000+ failures, zero successful sign-ins | vendor (Microsoft) |
| One vendor app credential, 15 Oct, 06:13 to 08:34 UTC | 141 minutes; 173 tenants confirmed (Huntress also reported at least 162) | independent (The Hacker News, Help Net Security) |
| Pace through confirmed tenants | 141 × 60 ÷ 173 = one tenant every 49 seconds (52 s on 162) | our maths |
| Microsoft’s figure: 2,250+ tenants at 2,900 sign-in attempts a minute | 2,250 ÷ 2,900 = 0.78 minutes: every tenant touched once in 47 seconds | vendor, our maths |
| First use to vendor shutdown (17 Oct, 05:00 UTC) | 46 hours 47 minutes | independent (The Hacker News), our maths |
| Tokens still valid after the app is disabled | up to 90 minutes | independent (The Hacker News) |
| Microsoft’s review window: from 1 Oct where records exist, to 22 Oct | 21 days. Salesforce free event logs keep 1 day: 1 ÷ 21 = 4.8% kept, 95.2% gone. Event Monitoring (30 days) covers it | vendor (Microsoft, Salesforce Event Monitoring FAQ), our maths |
The front door held: 151,000 guesses, nothing. The side door was a vendor app that every customer had already consented to, and it opened a tenant every 49 seconds. Huntress saw application sign-ins across more than 10,000 tenants with ConnectWise apps (independent, The Hacker News), so 173 confirmed is at most 1.7% of that view (our maths). The 1.7% is who got hit. The exposure was every tenant that clicked consent.
Missing
What ConnectWise and Microsoft have not said, as of 22 October:
- How the application credential was stolen. ConnectWise says “compromised application identities”; whether a product flaw contributed is not established (vendor, via Help Net Security).
- How many customer tenants were compromised in total. Microsoft did not say (independent, CyberScoop).
- What was read. Some directory reads are not logged, so “no evidence” is a weaker statement than it sounds.
- Whether the Cloud Management apps that gave themselves admin roles in about 50 organisations were ConnectWise automation or the attacker (independent, Help Net Security).
- A restoration date with criteria. Backups are not running while the service is down (independent, Help Net Security).
- A complete app list. Microsoft’s mitigation text says “all four application IDs” and lists three; The Hacker News lists seven (vendor, independent).
- Where the vendor stores the credential that works across every tenant, and how fast it can be revoked everywhere at once.
Who owns what
The vendor’s credential hygiene is their job. What their app is allowed to do in your org is ours.
Salesforce has seen this shape. From 8 to 18 August 2025, attackers used stolen Salesloft Drift OAuth tokens to pull Account, Contact, Case, and Opportunity records from customers’ Salesforce orgs; Salesforce disabled every Salesloft integration, and Okta’s attempt was blocked by inbound IP restrictions and token binding (independent, The Hacker News). Since September 2025 Salesforce blocks uninstalled connected apps by default for users without the Approve Uninstalled Connected Apps or Use Any API Client permission (independent, MoveData docs). That closes the casual door. It does nothing about a vendor app you installed on purpose.
In the stack: every vendor gets its own integration user and a connected app or External Client App set to “Admin approved users are pre-authorized”, the narrowest OAuth scopes it needs, and IP restrictions to the vendor’s addresses. Outbound calls from your org go through Named Credentials. Logs go to your SIEM before the one-day window closes. Revoking a vendor should be one switch, and someone should know where it is.
Monday morning
- Step 1. If any ConnectWise app is consented in your tenant, keep it disabled and preserve logs first. Search by application ID, not name, review from 1 October, and do not delete the enterprise app before evidence is saved (vendor, Microsoft). Owner: Microsoft 365 admin with security operations.
- Step 2. List every vendor app with standing access. Entra enterprise apps with application permissions, and Salesforce connected apps and External Client Apps from Setup > Apps > Connected Apps > Manage Connected Apps, with business owner, scopes, and last use. Owner: Salesforce admin and Entra admin.
- Step 3. Cut what nobody owns. Revoke tokens for apps with no named owner or no use in 90 days. Move the rest to admin-approved users and add IP restrictions. Owner: CISO signs off; Salesforce architect executes.
- Step 4. Keep the logs long enough to matter. Thirty days of Event Monitoring at minimum, or ship the daily files to your SIEM, with an alert on any app granting itself a role or adding a secret. Owner: security operations.
- Step 5. Ask each vendor three questions in writing. Where is the cross-tenant credential stored, how often is it rotated, and how fast can you revoke it everywhere? Date the reply and file it with the contract. Owner: vendor management.
We move this to WATCH if ConnectWise’s root cause shows a flaw that no customer-side control could have contained.
Frequently asked questions
What happened in the ConnectWise Cloud Backup breach?
An attacker used a stolen credential belonging to the ConnectWise Cloud Backup app, formerly SkyKick, to sign in to customer Microsoft 365 tenants on 15 October 2026. Huntress confirmed 173 tenants. ConnectWise disabled seven application identities on 17 October, and on 21 October Microsoft attributed the attack to Storm-0940, a China-state aligned group using the ARTEX agentic penetration testing framework.
Does the ConnectWise breach affect Salesforce?
Nothing published names Salesforce. The pattern applies, though: a vendor app with standing OAuth access to your org can be used by whoever steals its credential, as the Salesloft Drift tokens were against Salesforce orgs in August 2025. Audit your connected apps on that basis.
What should a Salesforce admin check first?
List every connected app and External Client App with its owner, scopes, and last use. Revoke what nobody owns, set the rest to admin-approved users with IP restrictions, and make sure event logs are kept or exported for longer than Salesforce’s free one-day window.
Living page. Last updated 22 Oct 2026. What would change our call: ConnectWise’s root cause showing a flaw no customer-side control could have contained.