Full Report
Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs
Analysis Summary
# Incident Report: Compromised ConnectWise Cloud Backup Credential Used to Access 173 Microsoft 365 Tenants
## Executive Summary
Unknown threat actors used a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to obtain Microsoft Graph tokens in customer tenants where the app is installed. Huntress observed confirmed unauthorized sign-ins in 173 partner and customer tenants, and in at least one partner tenant a separate ConnectWise app granted itself Global Administrator and added credentials to other privileged applications. ConnectWise has suspended Cloud Backup application access until further notice and reports no evidence that partner backup data was compromised.
## Incident Details
- **Discovery Date:** Reported publicly around October 17, 2026. Huntress identified the activity, and the article date is October 17, 2026. The exact internal detection date is not stated.
- **Incident Date:** Password spraying against four law firm tenants on October 13–14, 2026. Malicious token acquisition on October 15, 2026, between 06:13 and 08:34 UTC.
- **Affected Organization:** ConnectWise Cloud Backup (formerly SkyKick), the vendor. Downstream impact falls on MSPs and their customers with the app consented in their tenants. Four law firm tenants were targeted by password spraying.
- **Sector:** Managed service providers (MSPs) and their clients. Law firms were specifically targeted in the spraying activity. Other affected sectors are not disclosed.
- **Geography:** Not disclosed.
## Timeline of Events
### Initial Access
- **Date/Time:** October 13–14, 2026 (password spraying); October 15, 2026, 06:13–08:34 UTC (token acquisition in customer tenants).
- **Vector:** A compromised ConnectWise Cloud Backup Microsoft 365 credential (the app's service credential). How the credential was compromised is not stated.
- **Details:** The actor authenticated to the app using their own tooling, mimicking the backup service, and obtained Microsoft Graph tokens carrying the app's existing permissions. The activity came from IP 144.172.64[.]128. The same IP performed password spraying against four law firm tenants on October 13 and 14, with no successful user sign-ins detected in Huntress telemetry. The actor moved through tenants in sorted GUID order, a few seconds apart, which suggests a scripted target list.
### Lateral Movement
- Movement occurred across tenants, not within a single network. The attacker iterated through 173 partner and customer tenants using the same credential.
- In at least one partner tenant, a ConnectWise Cloud Management app for Microsoft Teams (application ID 24205314-2b89-4e07-a2a4-579e898a5640) added itself to the Global Administrator role.
- That app then ran a Python script (User-Agent `Python-urllib/3.12`) that added new client secrets to two other applications in the tenant: an MSP management application and the Huntress Security Platform application.
- Credentials added to MSP management applications can extend access beyond a single tenant because those apps are often consented into customer tenants.
### Data Exfiltration/Impact
- The stolen tokens could read mailboxes, files, and directory data accessible to the backup service. The access inherited read/write permissions to mail and attachments (including full mailbox access via Exchange Web Services), OneDrive and SharePoint files, and Teams chats, and included the ability to restore data.
- ConnectWise states it has found no evidence that Cloud Backup partner backup data was compromised.
- Confirmed data access volume and specific data taken are not disclosed.
### Detection & Response
- **Detection:** Huntress identified confirmed unauthorized sign-ins across 173 tenants and published its analysis. Todyl independently detected an unauthorized party authenticating to Microsoft Graph as the Cloud Backup application.
- **Response:**
- ConnectWise closed Cloud Backup application access until further notice.
- ConnectWise published indicators of compromise, including a Microsoft Entra Admin Center hunt (Monitoring → Sign-in logs → Service principal sign-ins, filtered by application ID).
- Researchers advised that revoking user sessions does not end this access. Disabling the app in a tenant blocks new token issuance, but already-issued tokens remain valid for up to 90 minutes. Tenants with the app still enabled remain exposed until ConnectWise rotates the credential.
## Attack Methodology
- **Initial Access:** Use of a compromised vendor service credential (Microsoft 365 app identity) to obtain Graph tokens in consenting tenants.
- **Persistence:** Ongoing access via the vendor app's existing consent. Additional persistence was established by adding new client secrets to trusted privileged applications (an MSP management app and the Huntress app).
- **Privilege Escalation:** A ConnectWise Teams app added itself to the Global Administrator role in at least one partner tenant.
- **Defense Evasion:** Authentication through custom tooling that mimics the legitimate backup service. The attacker used the app's existing permissions, so activity resembled normal app behavior. Not all evasion details are published.
- **Credential Access:** Compromised vendor credential. Password spraying against law firm tenants (October 13–14) from the same IP.
- **Discovery:** Enumeration of tenants in sorted GUID order, suggesting a predefined target list. Directory data access was possible through the Graph permissions.
- **Lateral Movement:** Cross-tenant movement using the vendor credential. Within a partner tenant, abuse of the privileged app to reach other trusted applications.
- **Collection:** Access to mailboxes, OneDrive, SharePoint, Teams chats, and directory data via Graph tokens. Specific collection activity is not detailed.
- **Exfiltration:** Not described in the available text.
- **Impact:** Unauthorized access to tenant data and creation of additional credentials and privileged role assignments that extend the risk beyond the vendor account.
## Impact Assessment
- **Financial:** Not disclosed.
- **Data Breach:** Potential exposure of email (including attachments), OneDrive and SharePoint files, Teams chats, and directory data across 173 tenants. ConnectWise reports no compromise of partner backup data. Confirmed exfiltration is not documented in the available text.
- **Operational:** Cloud Backup access was suspended for MSPs and customers relying on it for backup and recovery. Tenants must take manual remediation steps.
- **Reputational:** Significant. The incident affects a vendor trusted with broad access across MSP customer environments, and the attack extended into security tooling (Huntress) and privileged management applications.
## Indicators of Compromise
- **Network Indicators:**
- IP address: 144.172.64[.]128 (Microsoft Graph token acquisition, October 15, 2026; password spraying against law firm tenants, October 13–14, 2026)
- Application ID: 24205314-2b89-4e07-a2a4-579e898a5640 (ConnectWise Cloud Management app for Microsoft Teams)
- Application ID (ConnectWise Cloud Backup, truncated in source): 506e0…
- **File Indicators:**
- Python script using User-Agent `Python-urllib/3.12`, used to add client secrets to applications. No file hashes were reported in the available text.
- **Behavioral Indicators:**
- Service principal sign-ins for the Cloud Backup app from unfamiliar IPs or at unusual times
- Sequential, rapid authentication across tenants in sorted GUID order
- Application added to the Global Administrator role by itself
- New client secrets added to MSP management and security tool applications
- Password spraying against law firm tenants
*Note: The source article was truncated before the full indicator list. Consult ConnectWise's advisory and the Huntress and Todyl write-ups for complete IOCs.*
## Response Actions
- **Containment:**
- ConnectWise closed Cloud Backup application access until further notice.
- Administrators should disable the Cloud Backup app in their tenants to stop new token issuance.
- Revoke sessions and tokens where possible, recognizing that tokens may remain valid for up to 90 minutes.
- **Eradication:**
- ConnectWise is expected to rotate the compromised credential. Tenants should not consider the threat resolved until rotation is confirmed.
- Remove unauthorized Global Administrator role assignments and rogue client secrets on affected applications (MSP management apps and security tool apps).
- **Recovery:**
- Reenable the app only after ConnectWise confirms credential rotation and the advisory is lifted.
- Review tenant logs for unauthorized access and validate the integrity of mailboxes, files, and directory settings.
## Lessons Learned
- **Key Takeaways:**
- A single vendor service credential can grant access across many customer tenants when broad consent is in place.
- Disabling an app or revoking sessions does not fully remove access while previously issued tokens remain valid.
- Applications with privileged roles can be abused to add credentials to other trusted applications, creating cross-tenant and cross-tool exposure.
- Third-party apps with broad Graph permissions (mail, files, Teams, directory) represent a high-value target.
- **What Could Have Been Done Better:**
- Limit consented permissions to the minimum needed for the service.
- Restrict the ability of applications to assign directory roles or add credentials to other applications.
- Monitor service principal sign-ins and alert on unusual source IPs or user agents.
- Protect vendor service credentials, including strong authentication and secret rotation.
## Recommendations
- **Review and reduce app consent:** Audit enterprise applications and consented permissions, and remove unneeded Graph scopes, especially mail, files, and Teams access.
- **Hunt for IOCs now:** Search Entra sign-in logs for the listed IP and application IDs, and review service principal sign-ins for the Cloud Backup app.
- **Audit privileged role assignments:** Check for applications, not just users, holding Global Administrator or other privileged roles, and verify they were assigned legitimately.
- **Audit application credentials:** Review recently added client secrets and certificates on all applications, particularly MSP management and security tool apps. Rotate any suspicious secrets.
- **Restrict application administration:** Limit who and what can add credentials to applications and assign directory roles. Use privileged role governance such as Privileged Identity Management.
- **Apply Conditional Access for workload identities:** Restrict where service principals can sign in from, based on trusted IP ranges or locations.
- **Monitor for password spraying:** Enable alerting for spray patterns against tenants, especially for high-value sectors such as law firms.
- **Revoke and rotate:** Revoke active sessions and tokens, disable the affected app until it is safe, and rotate any credentials that may be exposed.
- **Vendor risk management:** Require MSP and security vendors to disclose their app permissions and credential management practices, and monitor their advisories.