Containment threshold for suspicious ConnectWise tenant activity

The activity reviewed on October 25, 2026 combined broad, high-rate targeting with a smaller successful-access cluster.

Microsoft reporting summarized for the Roundtable described 151,000+ failed sign-ins against 2,250+ ConnectWise tenants at up to 2,900 attempts per minute, while separately reporting 200+ sign-ins in under four minutes using four application credentials and involving 327 accounts across eight organizations.

That combination requires prompt tenant-level review, but the evidence does not justify labeling every targeted tenant compromised. The immediate decision is therefore whether local records show the successful access and unauthorized post-authentication activity needed to trigger containment.

Three populations require distinct treatment.

First, operators of the 2,250+ ConnectWise tenants reached by 151,000+ failed sign-ins must investigate, but those failed attempts alone establish targeting rather than compromise.

Second, identity and security teams responsible for the 327 accounts across eight organizations associated with 200+ sign-ins in under four minutes using four application credentials face a narrower, higher-concern successful-access scenario.

Third, administrators of ConnectWise customer environments showing unauthorized application-identity access, Microsoft Graph reconnaissance, credential modification, persistence, privileged-role changes, or other unexplained directory activity must contain the affected identities and escalate.

The packet does not identify a specific ConnectWise version or deployment configuration.

1) Supporting evidence: The intelligence analyst's October 25, 2026 summary of Microsoft reporting states that “2,250 is exposure, not compromise.” It reports 151,000+ failed sign-ins reaching 2,250+ tenants at up to 2,900 attempts per minute, separately from 200+ sign-ins in under four minutes using four application credentials and involving 327 accounts across eight organizations.

This supports separating widespread targeting from the narrower successful-access population.

2) Supporting evidence: The same summary describes unauthorized access to ConnectWise application identities and follow-on Microsoft Graph reconnaissance and credential modification in multiple customer environments. This supports using post-authentication behavior as the containment threshold.

3) Supporting assessment: The evidence review found that the cited materials consistently support examining authentication, administrative-session, OAuth, application-credential, and directory-change records, then revoking unexplained sessions and credentials when successful access and follow-on activity are corroborated.

4) Limiting evidence: A separate evidence review found that Microsoft supplies the Storm-0940 attribution while ConnectWise corroborates the incident but not the actor, so it contradicts any unqualified claim of independently established end-to-end actor control.

The intelligence analyst first separated the reported 151,000+ failed sign-ins reaching 2,250+ ConnectWise tenants from the narrower evidence of successful access: 200+ sign-ins in under four minutes using four application credentials, involving 327 accounts across eight organizations.

The decision scout converted that distinction into an operational threshold: failed attempts establish targeting, while unexplained successful access followed by administrative or directory activity triggers containment.

The evidence assessment found strong support for that threshold but identified a gap in attributing the complete chain to Storm-0940.

The boundary review resolved the disagreement by keeping the behavior-based response while describing Storm-0940 as Microsoft-reported rather than independently established. A record comparison found no matching prior decision, and the arbiter selected a new operational-action record.