Attackers Abuse ConnectWise Cloud Backup Credential to Breach Over 300 Microsoft 365 Tenants
Do Son 
TL;DR
Threat actors stole a vendor API secret belonging to ConnectWise Cloud Backup (formerly SkyKick) to access customer Microsoft 365 environments. During this ConnectWise Cloud Backup breach, attackers signed in to over 300 Microsoft Entra tenants and planted backdoor credentials in select environments. Consequently, ConnectWise suspended its backup and management services while security teams urge administrators to audit their application secrets immediately.
What Happened in the Attack
On October 15, 2026, an unauthorized party used a compromised vendor credential to authenticate into customer Microsoft 365 tenants. According to an investigation by Huntress, the primary ConnectWise Cloud Backup application (ID: 506e08f9-6e9a-4da4-942b-a099a03644ae) requested Microsoft Graph tokens from IP address 144.172.64.128. Normally, legitimate traffic from this service originates inside private Microsoft Azure IP space. However, between 06:13 and 08:34 UTC, an automated script cycled through customer tenants in sorted order to harvest access tokens.
“The credential type was a client assertion, which means the credential lives in the vendor’s own tenant. Nothing a customer did in their environment could have produced it,” Huntress researchers stated. In a separate advisory, ConnectWise acknowledged the unauthorized activity and temporarily shut down its Cloud Backup, SaaS Security, and Cloud Management services to replace application credentials.
Privilege Escalation and Backdoor Secrets
Beyond the initial token sweep, investigators uncovered post-compromise persistence in at least two customer environments. Specifically, around 03:45 UTC on October 15, a second vendor app named ConnectWise Cloud Management – MS Teams assigned itself the Global Administrator role. Next, the threat actor ran a Python script (Python-urllib/3.12) to attach new client secrets to existing third-party applications registered inside those tenants. Notably, in one partner environment, the attacker added a secret set to expire in 2028 directly onto the single-tenant Huntress Security Platform application and used it seven times before defenders removed it.
“The procedure was the same each time: the application granted itself Global Administrator, then planted a new secret on a small number of other applications in the tenant to keep a foothold,” the Huntress report noted. Because application-only sign-ins bypass multi-factor authentication (MFA) and user prompts, these planted secrets give attackers a hidden way back in even after the vendor resets its own keys.
Who Is Behind the Activity
Neither Huntress nor ConnectWise has attributed the intrusion to a specific threat group yet. Nevertheless, network logs show that the primary token collection originated from 144.172.64.128, an IP address hosted on RouterHosting (AS14956). Earlier, between October 13 and October 14, this same IP address conducted password spraying against four law firm tenants using curl/7.88.1. Meanwhile, the Global Administrator escalation originated from a private IPv6 Unique Local Address (fde4:8dba:2600:37ce:6d26:200:a76:*) used inside Microsoft’s own cloud network, making operator identification harder.
Later on October 15, between 09:25 and 14:20 UTC, the attacker launched a second, manual wave of login attempts from 144.172.64.128. This targeted sweep focused on 16 specific tenants across the national security, policy, trade, and critical mineral sectors. Fortunately, those attempts failed because the targeted organizations did not have the SkyKick service principal installed.
Impact and Scale Across Tenants
Across more than 10,000 monitored environments, Huntress identified nearly 1,000 Entra tenants with sign-in attempts from the attacker’s IP address, resulting in over 300 successful authentications. Furthermore, researchers confirmed that the attacker abused six distinct ConnectWise Cloud Management applications covering Exchange Online, Microsoft Teams, SharePoint Online, MS Graph, and Partner Center. Because ConnectWise Cloud Backup requires broad read and write permissions to protect company data, compromised tokens expose emails, SharePoint files, Teams chats, and directory records. While detailed audits of the two backdoored tenants showed no email or file manipulation, Microsoft does not log directory reads via Microsoft Graph, so silent data reconnaissance remains possible.
How Organizations Can Stay Protected
Although ConnectWise disabled the affected applications on October 17, administrators must still check their own environments for leftover backdoors from the ConnectWise Cloud Backup breach. First, defenders should open the Microsoft Entra admin center and disable all seven ConnectWise and SkyKick enterprise applications without deleting them. “Disabling M365 apps, including the abused ConnectWise apps will not remove credentials that were already added. You must review the credentials on all of your M365 applications,” Huntress warned.
Second, security teams should filter their Entra service principal sign-in logs for traffic from 144.172.64.128 between October 13 and October 16. In addition, administrators must inspect all Enterprise Applications and App Registrations for unexpected client secrets or certificates created since October 13. Finally, teams should remove any unauthorized Global Administrator or Exchange Administrator roles assigned to ConnectWise service principals and wait for official vendor confirmation before re-enabling backup tools.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
