GoKawiil
Tech News
Cybersecurity firm Huntress identified an active malware campaign exploiting compromised ScreenConnect cloud instances to push rogue remote-access clients onto customer devices. As of its initial report, six MSPs and 286 endpoints across 47 organizations were affected, with numbers still rising. ConnectWise confirmed it is investigating the activity alongside Huntress.
Microsoft's Security blog reports that Storm-0940, a China-state-aligned hacking group, used an open-source AI agentic penetration-testing tool called ARTEX to exploit stolen ConnectWise application credentials, attempting sign-ins across more than 2,250 Microsoft 365 tenants. The group also ran automated password-spraying attacks against 327 accounts at eight organizations, generating over 151,000 failed login attempts without success. Microsoft says the breach did not stem from any vulnerability in its own systems and that it remains unclear how the ConnectWise credentials were obtained or how many tenants were actually compromised.
Microsoft said the threat actor it tracks as Storm-0940 used compromised application credentials tied to ConnectWise Cloud Backup to try to access more than 2,250 downstream Microsoft 365 customer tenants. In some cases attackers reached privileged cloud access within three hours of targeting, and Microsoft said the group used an agentic AI penetration-testing framework to speed up the campaign. ConnectWise disclosed unauthorized access to its Cloud Backup application identities on Oct. 16 but has not said how attackers first obtained control of them.
Microsoft says China state-aligned hackers breached ConnectWise's cloud backup service and stole application credentials used to link ConnectWise with corporate customers' Microsoft-hosted environments. Using AI agents to automate sign-in attempts at nearly 3,000 per minute, the attackers gained access to roughly 2,250 organizations' emails and files. ConnectWise has paused access to the affected backup system and is investigating while working to restore service.
ConnectWise disclosed that a threat actor used credentials tied to its Cloud Backup product (formerly SkyKick) to authenticate into Microsoft 365 tenants, discovering unauthorized access to application identities on Oct. 14. The company has since disabled Cloud Backup, SaaS Security, and Cloud Management for partners and clients while an incident response firm investigates, leaving backup, restore, and monitoring functions unavailable.
ConnectWise shut down customer access to its Cloud Backup service, formerly SkyKick Cloud Backup, after attackers gained access to application identities used to connect to Microsoft 365 tenants. Microsoft confirmed unauthorized authentication attempts from an IP address on October 15, while security firm Huntress identified at least 162 compromised tenants in its own environment. ConnectWise says it has found no evidence that customer backup data itself was accessed, and existing backups remain intact.
CISA has added a critical ScreenConnect vulnerability, now designated CVE-2026-84869, to its known exploited vulnerabilities catalog after confirming attackers are actively abusing it. The flaw stems from missing authorization checks that let low-privilege users transfer and execute files during active remote sessions without host confirmation, and it has been fixed in ScreenConnect 26.6.5. Federal agencies have been given three days to patch, while Shadowserver reports over 1,000 unpatched, internet-exposed ScreenConnect servers, mostly in North America and Europe.
ConnectWise disclosed a new security flaw in its ScreenConnect remote access platform affecting file transfer behavior in both cloud and on-premises deployments. The vulnerability has no CVE identifier yet and no official patch, though the company says a fix is coming later this week. In the meantime, ConnectWise published manual mitigation steps requiring administrators to disable file transfer permissions across user roles.