On October 21, 2026, Microsoft reported a Storm-0940 campaign abusing ConnectWise application access. The actor used the agentic AI framework ARTEX to accelerate attacks and use compromised applications to reach Microsoft 365 environments. For organizations with 10 to 250 employees, the relevant question is whether affected integrations currently have, or previously had, permissions in their tenant. Company size alone does not establish exposure. Microsoft provides concrete investigation and containment guidance, but an installed application does not by itself prove a successful attack or data exfiltration.
What Microsoft reports about the campaign
According to Microsoft, the actor abused existing application permissions and stolen application credentials. This did not require an interactive user sign-in. In multiple customer environments, Microsoft observed subsequent Microsoft Graph activity, including reconnaissance, application credential changes, and attempts to expand privileges. The report does not attribute the activity to a compromise or vulnerability in Microsoft systems. For teams operating Microsoft Entra ID, the practical implication is clear: review application identities and their actions, rather than investigating only user accounts.
Which integrations need review now
Microsoft calls for reviewing every Microsoft 365 tenant where affected applications are currently or were previously installed or authorized. This includes integrations that are no longer used. Search by the application IDs in the current Microsoft profile, not just display names, and record each tenant-specific service principal Object ID. Start by establishing the following facts:
- Current or historical ConnectWise applications, their enabled state, and the permissions they hold.
- Successful and failed service principal sign-ins, separated by result and investigation period.
- Unexpected new credentials, owners, consent grants, application roles, or privileged role assignments.
- Suspicious Graph activity and unusual mail, file, or forwarding operations following authentication.
Distinguish deadlines from the investigation window
This notice does not set a universal migration deadline. Microsoft recommends reviewing activity from at least October 15, 2026; where records are available, extend service principal sign-in review back to October 1. These dates define investigation coverage, not shutdown deadlines. Affected ConnectWise application connections should remain disabled until the vendor provides formal restoration instructions. Preserve available records without delaying urgent containment until exports finish. Explicitly assess the operational effect on backup and restore workflows. Independently re-enabling a connection simply to resume normal operations would not follow the process Microsoft describes.
Why one matching event does not prove an incident
Microsoft distinguishes application presence, successful authentication, and subsequent resource access. Neither installation nor a successful sign-in alone establishes data exfiltration. Conversely, an absence of Graph results does not confirm that no access occurred. Investigators need to correlate sign-ins, permissions, audit records, and available resource activity. Microsoft also explains that service principal sign-ins under matching conditions are grouped in the logs. Expand those rows to inspect individual timestamps rather than treating an aggregated entry as one event.
The report provides detections and hunting queries for Microsoft Defender. Results still require comparison with authorized administrative changes. Do not restrict the investigation to published IP addresses. Additional credentials created by the actor can persist after remediation of the original application. A single reassuring finding therefore should not automatically close the investigation. Record which evidence supports each conclusion and which portions of the relevant timeline remain unobserved.
Concrete next steps for affected small businesses
For small IT teams, we recommend assigning clear ownership and maintaining a shared investigation record. This organizational approach is a ReByteIT recommendation; the technical measures follow Microsoft’s response guidance. Prioritize traceable containment and evidence preservation rather than indiscriminately deleting integrations. Keep operational decisions separate from conclusions about whether data was accessed, and document the reasoning for both.
- Inventory affected tenants and application IDs, map local Object IDs, and assign authorized response owners.
- Keep affected connections disabled; do not delete enterprise applications as the first response. Preserve configuration and evidence.
- Correlate Entra sign-in and audit records, Microsoft 365 audit data, and previously available Graph and SIEM telemetry.
- Have authorized responders remove confirmed unauthorized credentials and permissions; on confirmed suspicious activity, revoke unnecessary permissions and rotate credentials.
- Verify that no unauthorized access remains, assess backup and restore impacts, and review current vendor instructions before restoration.
Official Microsoft sources
- Microsoft Security Blog: Storm-0940, ConnectWise, and concrete protection guidance
- Microsoft Learn: monitoring applications and permission changes
- Microsoft Learn: service principal sign-ins and grouped log entries
Through our Microsoft Security Assessment, we support the technical review of Microsoft 365 identities and application permissions. The starting point is documented evidence and agreed actions, not a blanket assumption that your environment has been compromised.
What does this mean for your environment?
Assess the topic in the context of your Microsoft 365 environment and define a practical next step.
You speak directly with Sebastian Kerssen – working in the Microsoft ecosystem since 2014, with personal consulting and a dedicated point of contact.
