Faster Threats, Stronger Defenses: A Proactive Approach to Cybersecurity
Practical Steps to Protect Access, Respond to Vulnerabilities, and Reduce Security Risks
It’s a brave new world.
Recent security events across the globe are reinforcing an important lesson: advance preparation matters. Cybersecurity threats challenge internal and external security teams daily, and organizations need to adapt without losing sight of the fundamentals. Strong authentication, established security policies, and a proactive approach to vulnerabilities can reduce opportunities for attackers, and help avoid wasted time, unnecessary costs, and disruption to clients.
Below, Kraft Kennedy CISO Nett Lynch shares practical defensive lessons from vendor-credential activity associated with a recent security event involving Kraft Kennedy. That activity is separate from our team’s response to PHP-related vulnerabilities, which we reviewed, here.
This blog focuses on practical defensive lessons; it does not serve as a final review of our ongoing, broader investigation.
Evolving Threats: Less Time to Respond
Attackers use automation to operate at speed and scale, but a high volume of attempts alone does not prove AI involvement. In its October 27 update, Huntress also notes that Storm-0940 is one of many threat actors using ARTEX, so use of the framework alone is not a reliable indicator of who is behind an attack. That external attribution is separate from our security team’s assessment of rapid shifts in activity: evidence of automation and attribution of AI use are not interchangeable. As one security founder told CSO Online, defenders should focus on what an identity is doing rather than whether a person or an AI agent is controlling it.
The change is not necessarily a new type of attack. It is how quickly attackers can move between tasks: look for exposed systems, identify weaknesses, and adjust their next steps as new information becomes available. Our review showed this shift from repeating a single automated task to more adaptive activity. For defenders, that means preparation must address both the volume of attempts and the speed at which an attack can change direction. Microsoft reported that in multiple instances the attackers gained privileged access to an organization’s cloud environment less than three hours after first targeting it. A Microsoft executive vice president also described the ConnectWise attack as “one of many” in a wave of AI-driven attacks underway since early October.
The practical implication is the same: organizations need to detect, assess, and respond to threats promptly. A routine patching schedule alone may not be enough when a newly disclosed vulnerability is being actively exploited. Security teams need a way to act on urgent alerts outside the normal maintenance cycle. With sign-in attempts reported at up to 2,900 per minute, industry analysts note that containment steps such as disabling credentials and isolating applications increasingly need to trigger automatically, with people reviewing them afterward. An urgent vulnerability response may require more than faster patching. A vulnerability can be exploited before a vendor releases a fix, and exposure can continue until the fix is applied. During that window, temporarily taking an affected service offline may be a protective option. The decision must weigh security risks against business disruption. Agreeing in advance on how those decisions will be made helps turn an urgent recommendation into a workable response.
Defensive Lessons: Protect User and Application Access
During the event, automated attempts to sign in to our users’ accounts failed, supported by passwordless authentication, conditional access policies, and security procedures developed over time. Separately, roughly 2,000 automated attempts to sign in as our applications were rejected because the attacker did not hold valid application credentials. Those prevented sign-ins should not be read as a conclusion about every part of the ongoing event.
There are two kinds of access to protect: people signing in and applications connecting to services. Passwordless authentication reduces reliance on passwords that attackers can obtain or misuse, helping protect user accounts. Applications also have identities and credentials of their own. An application ID names the application; it does not grant access by itself. In its ConnectWise advisory, Huntress confirmed that attackers used a compromised API secret, a credential used by software, belonging to ConnectWise Cloud Backup, formerly SkyKick, to gain unauthorized access to customers’ Microsoft 365 environments. Protecting user sign-ins is important, but connected applications need protection too. As one security founder put it to CSO Online, “We’ve spent years implementing zero trust for humans while continuing to implicitly trust machines”. The same article notes that an application no longer in use may still hold permissions in an environment today.
Disabling the application used for the initial entry may not remove every route an attacker has created. Huntress reported that, in one partner tenant, an abused ConnectWise application granted itself Global Administrator privileges, a highly privileged administrative role, and added credentials to other applications. Those added credentials remain even when the original application is disabled. Microsoft has likewise warned that changes like these can remain active as a backdoor even after the original application is remediated. Huntress therefore calls for reviewing credentials across all Microsoft 365 applications, not just the affected vendor app. These findings concern other environments; they do not establish that the same activity occurred at Kraft Kennedy.
Supply-chain risk is another reminder that security does not stop at an organization’s own systems. ConnectWise’s CEO noted that “one trusted connection can open the door to many organizations”. Industry analysts describe the responsibility as shared: vendors must protect the credentials that reach into customer environments, and customers need to know what access they granted, to whom, and for how long . Third-party risk management and vendor due diligence belong alongside internal safeguards. The goal is not to add more tools, but to remove unnecessary opportunities for attackers to gain entry.
What Remains Unknown
Microsoft has not disclosed how many organizations were compromised or whether any data was taken, though it reported that the attackers established persistent privileged access at numerous organizations. ConnectWise has said it cannot determine whether a specific partner or customer environment was compromised, and Microsoft cautions that a successful sign-in does not necessarily mean data was accessed. Huntress identified almost 1,000 Microsoft 365 tenants with sign-in activity from one attacker address, including more than 300 successful authentications. For long-lived, sensitive information such as legal matter data, organizations should plan for the possibility that encrypted data collected today could be decrypted later, a tactic known as “harvest now, decrypt later.” That is a reason to limit how much sensitive data is retained and to plan for stronger encryption over time.
Client Priorities: Turn Lessons into Action
- Reduce reliance on passwords. Work with your IT provider to evaluate passwordless authentication and review access policies.
- Modernize vulnerability responses. Plan for urgent security alerts that cannot wait for the next maintenance window. Agree on how those alerts will be assessed and how patches or temporary protective measures will be implemented.
- Address end-of-life systems. Identify technology that no longer receives security updates and establish a plan to replace or retire it.
- Review third-party exposure and application credentials. Revisit vendor due diligence. Review the credentials and privileges of connected Microsoft 365 applications, including applications you no longer use. If your environment contains the affected ConnectWise applications, follow Huntress’s containment guidance. Disable affected applications rather than delete them, and review credentials on all applications. Do not re-enable affected ConnectWise applications until ConnectWise confirms that all credentials have been reset. While access is disabled, confirm backup retention and restore options with the vendor.
- Plan for long-lived data sensitivity. Limit how long sensitive data is retained, and work with your IT provider on a plan for stronger encryption over time.
End-of-life technology creates a different problem from a delayed patch: the vendor is no longer providing security updates. Faster maintenance cannot deliver a fix that will never arrive. That is why identifying unsupported systems and planning their replacement or retirement is a security priority, not simply a technology-refresh exercise.
Clients do not have to navigate these changes alone. An IT provider, managed service provider (MSP), or managed security service provider (MSSP) can help turn security recommendations into manageable next steps. The purpose of these priorities is to adapt to changing risks—not add technology for its own sake.
Next Steps
Schedule a security-priorities review with your Kraft Kennedy team to identify the most important gaps and agree on the first actions. Bring your current authentication approach, patching process, end-of-life system inventory, and key vendor dependencies. Use the review to leave with agreed first actions, an owner for each action, and a follow-up date.
More Information
Huntress, “ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks”, Jonathan Semon. Published October 16, 2026; includes an October 27, 2026, update. Accessed November 5, 2026. Findings and guidance may change as the investigation continues.
Microsoft Security Blog, “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise,” October 21, 2026: https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
ConnectWise Trust Center, Cloud Backup (formerly SkyKick) service interruption advisory: https://www.connectwise.com/company/trust/advisories
Huntress, Storm-0940 threat actor profile: https://www.huntress.com/threat-library/threat-actors/storm-0940
The Register, “Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants,” October 22, 2026: https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687
CSO Online, “China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants,” October 22, 2026: https://www.csoonline.com/article/4239028/china-linked-hackers-used-agentic-ai-in-attack-on-2250-microsoft-365-tenants.html
Dark Reading, “Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack”: https://www.darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack
CyberScoop, Microsoft attributes ConnectWise supply chain attack to Storm-0940: https://www.cyberscoop.com/microsoft-attributes-connectwise-supply-chain-attack-china-storm-0940/
Cybersecurity Dive, China-nexus actor linked to ConnectWise Cloud Backup attack: https://www.cybersecuritydive.com/news/china-nexus-actor-attack-connectwise-cloud-backup/833727/
Stay Connected
Looking for more ways to interact with Kraft Kennedy?
Check out our upcoming events!