title: ConnectWise Cloud Backup Storm-0940 IOC IP Sign-in
id: 6f2d1c3e-8a4b-4f7e-9c21-3b5d7e9a1c01
status: experimental
description: Entra ID sign-in (user or service principal) from IP addresses Microsoft and ConnectWise published for the ConnectWise Cloud Backup (formerly SkyKick) application-identity compromise attributed to Storm-0940. The 187.15.x VPN addresses are only meaningful on 15-16 Oct 2026.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
    - https://www.connectwise.com/company/trust/advisories
author: Cybaverse
date: 2026-10-22
tags:
    - attack.initial-access
    - attack.t1078.004
    - attack.t1195
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        IPAddress:
            - '144.172.64.128'
            - '144.172.64.99'
            - '144.172.64.60'
            - '187.15.88.186'
            - '187.15.90.217'
            - '187.15.89.186'
    condition: selection
falsepositives:
    - VPN addresses (187.15.x) are shared and transient; outside 15-16 Oct 2026 matches are likely unrelated
level: high