The backup vendor is the new front door, and AI just kicked it in

Which of your vendors could sign in to your Microsoft 365 tenant right now without a password, without MFA and without anyone noticing? If you can't answer, the ConnectWise Cloud Backup incident was written for you.

The short version: ConnectWise suspended Cloud Backup (formerly SkyKick), along with its SaaS Security and Cloud Management services, after suspicious activity was first detected on Oct. 14. Cybersecurity Dive reports that a Microsoft report ties the campaign to a China-nexus group tracked as Storm-0940. According to that report, the group used an open-source agentic AI pen-testing tool called Artex. Microsoft says it tried to sign in to more than 2,250 Microsoft 365 tenants, at 2,900 attempts per minute.

The credential was the attack, not the product

Notice what didn't happen. According to Sophos, the sign-ins needed no user password and no MFA, because the actor authenticated as the vendor's own application identity. Sophos says the scanning ran from a single server for about 96 minutes. It also says it is unclear how the credential was obtained.

That is the uncomfortable design truth of multi-tenant backup apps. Customers consent once, and the vendor's identity can then request tokens in every consenting tenant. As Huntress's Jon Semon told CyberScoop, anyone holding the credential can request tokens in any tenant where the app is installed, with no action by the customer. We think that is a concentration of risk most buyers never priced in. You bought a backup service. You also handed a third party a master key, and its security became yours.

The backup angle makes it worse. SOCRadar's summary notes that these products often need broad permissions, which can include mailboxes, files and directory data. They also reach those tenants through MSPs, who sit one hop from many small organizations. For an attacker, that is a very efficient place to be.

"Scale like a startup" is the real news

The AI part deserves skepticism and respect in equal measure. Skepticism, because Huntress calls its view a "working hypothesis": an AI agent running scripted tooling, with occasional human intervention. Respect, because the scale is what matters. Enumerating tenants was never hard. What changes is the cost of the next step, such as recon, privilege escalation or planting persistence, across hundreds of targets at once.

ConnectWise's CEO put it well, saying AI lets attackers test trusted connections at what Microsoft calls "machine speed." We'd add that defenders' processes still run at human speed: tickets, vendor emails, weekly reviews. Microsoft's own numbers show 151,000 failed logins in a few days. Most defenders can't stop that rate by hand.

One caveat on attribution. Other reporting, including CyberScoop's, said the actor had not been identified, and SOCRadar said the same. The Microsoft attribution came later. Also, the scale figures are not all confirmed compromises. SOCRadar stresses that almost 1,000 tenants with sign-in activity should not be read as 1,000 breaches.

Treat backup and MSP tooling as tier zero

Here is our stance. Security teams have long protected domain controllers and identity providers as crown jewels. A backup connector with rights to read and write mail and files, as Todyl described, belongs in that same tier. In practice that means:

• Inventory every third-party app with consent in your tenant, and match on Application ID, not display name, as ConnectWise advises.
• Alert on service principal sign-ins from unexpected IPs. In this case the app appeared from a server rather than the Azure infrastructure normally associated with it.
• Watch for apps that grant themselves roles or add secrets to other apps. Huntress saw exactly that, and it means disabling the original app is necessary but may not be sufficient.
• Don't assume silence in the logs means safety. SOCRadar notes that some Graph reads leave limited audit trail.

The loser here is the old trust model, where a vendor's SOC claim stood in for your own controls. The winners are the attackers, until buyers demand credential isolation and tenant-level visibility from backup vendors. ConnectWise itself said its architecture doesn't give it enough visibility into downstream tenants to know who was affected.

Our verdict: don't wait for the post-mortem. If you run Microsoft 365 through an MSP, ask this week which vendor identities hold consent, what they can touch, and who gets alerted when they misbehave. AI didn't invent this weakness, but it made it cheap to exploit at scale.