ConnectWise Cloud Backup Supply-Chain Attack: Detecting and Remediating Compromised Microsoft 365 Tenants

Hackers Use Stolen ConnectWise Cloud Backup Credential to Access Microsoft 365 Tenants

by

Hackers compromised a trusted Microsoft 365 backup application credential belonging to ConnectWise Cloud Backup, using it to sign in across 173 customer and partner tenants. ConnectWise shut down customer access to the cloud backup service while investigations continue into unauthorized application identity access.

A major software supply chain incident has compromised Microsoft 365 cloud environments through a trusted third-party vendor integration. ConnectWise cut off customer access to its ConnectWise Cloud Backup service—formerly known as SkyKick Cloud Backup—after confirming that attackers gained access to application identities within the backup environment. Security researchers and tech giants revealed that the breach allows unauthorized application access to downstream corporate tenants without requiring a user password or multi-factor authentication prompt.

How the Compromised ConnectWise Cloud Backup Credential Opens Microsoft 365 Tenants

The security failure exploits the fundamental mechanics of cloud workload identities. When organizations onboard a third-party tool like a backup solution, they grant the software explicit application permissions in advance so it can operate unattended without human intervention. According to technical analyses from security platforms, the threat actor authenticated directly to Microsoft Graph using the compromised backup application secret.

Because the application already held broad, previously granted permissions in each tenant, those automated sign-ins gave the attacker the technical ability to read and write mail and attachments, access OneDrive and SharePoint files, and inspect Teams chats. Standard user protections fail in this scenario because no human user is logging in.

Compromised ConnectWise App Hits 173 Microsoft 365 Tenants — AOMEI Supply‑Chain, OpenBSD PoC, AitM P

The access inherited the app’s existing consent, which permits read/write access to mail and attachments (full mailbox access through Exchange Web Services), OneDrive and SharePoint files, and Teams chats, including the ability to restore data.

Nicholas Koken, Todyl’s head of Detection Engineering

Independent threat intelligence teams and cybersecurity firms began observing malicious activity tied to the incident. Huntress reported confirmed unauthorized sign-ins within 173 partner and customer tenants. Microsoft confirmed that it tracked an active supply chain attack abusing the OAuth app of ConnectWise Cloud Backup (AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae) to obtain access tokens across customer tenants. Microsoft observed broad successful service principal authentication originating from the IP address 144.172.64[.]128 on October 15, 2026.

Escalation Tactics and Persistence Mechanisms Observed in Target Tenants

Beyond initial reconnaissance and data access, investigators uncovered evidence of attackers attempting to cement their foothold inside breached environments. In at least one partner tenant, researchers observed a separate ConnectWise management application granting itself high-level administrative privileges and adding new credentials to other trusted applications.

Hackers Use Stolen ConnectWise Cloud Backup Credential to Access Microsoft 365 Tenants
Photo: Linkedin

The ConnectWise Cloud Management app for Microsoft Teams (application ID 24205314-2b89-4e07-a2a4-579e898a5640) added itself to the Global Administrator role, then ran a Python script (User-Agent Python-urllib/3.12) that modified two other applications in the tenant: an MSP management application, and Huntress’s own application (Huntress Security Platform), adding new client secrets to both.

Jonathan Semon

Security firms emphasize that adding a credential to a managed service provider management tool extends risk far beyond a single tenant because those administrative applications are frequently consented across multiple downstream client environments. Huntress observed that nearly 50 monitored tenants showed service principals for ConnectWise’s Cloud Management apps assigning themselves directory roles, primarily Exchange Administrator. While forensic analyses across several tenant intrusions revealed mostly automated sign-in activity and script-driven reconnaissance, the capability to alter directory permissions introduces severe secondary risks.

Remediation Guidance and Verification Steps for Cloud Administrators

ConnectWise took the service offline to stymie the campaign. In an October 17 service-status update, the company confirmed unauthorized access to application identities within its Cloud Backup environment and stated it was shutting off application access to interrupt customer backups while remediation continued. ConnectWise reported finding no indicators that stored partner backup data had been compromised, noting that backup archives remain unimpacted by the service interruption.

  • Go to the Microsoft Entra Admin Center, access Monitoring, open Sign-in logs, select the Service principal sign-ins tab, and filter by Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae to check for anomalous authentication.
  • Inspect application secrets and certificates added since October 13 across integrations, particularly looking for unauthorized credentials or unexpected directory roles.
  • Disable affected ConnectWise and SkyKick applications rather than deleting them outright, and avoid re-enabling integrations until ConnectWise officially confirms credential resets.

Security advisors caution that standard user password resets or employee multi-factor authentication policies do not secure independent workload identities. Because multi-tenant SaaS applications operate outside standard conditional access rules designed for human users, administrators must audit service principal permissions directly to ensure complete containment.

More on this story: TASK#STOMP Malware Uses Windows Tools to Steal Sensitive Enterprise Data · Espionage Groups Use BlueMoon Exploit Kit to Target Chrome and Windows · Windows Malware Bypasses Google Chrome Passkeys, Researchers Reveal

More on Microsoft: Microsoft Unveils AI Cybersecurity Tools and Agentic Threat Detection · Microsoft points to security feature causing Windows 11 remote Desktop failures · Microsoft Launches Project Perception and MAI-Cyber-1-Flash AI Security Tools

More on Cloud Backup

Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
ConnectWise Backup Breach Exposes 173 Companies and Critical Nextcloud Flaw Under Active Attack

Related reading

Read next