ConnectWise: compromised credential opens 162 Microsoft 365 tenants

ConnectWise has suspended Cloud Backup (formerly SkyKick Cloud Backup), the service many MSPs use to back up their customers’ mail, OneDrive, SharePoint and Teams, after identifying unauthorized access to the service’s application identities. A credential of the multi-tenant application was used to authenticate to customers’ Microsoft 365 tenants with the permissions already granted to the backup. Microsoft has described the incident as an active supply chain attack against the Cloud Backup OAuth application.

What happened

On October 17 ConnectWise disabled seven application identities, revoked the certificates of the connections and invalidated the shared Cloud Backup credentials. On October 18 it also took SaaS Security and Cloud Management, which are integrated with the backup, offline as a precaution. As of October 19 all three services were still suspended, with no restoration date: scheduled backups are not running, and archives can be neither browsed nor restored. According to the company, existing archives remain encrypted and isolated, with no sign of access.

How the credential was exposed, and whether a product vulnerability contributed, has not yet been established. ConnectWise does not comment on the actor and points out that it has no visibility into customer environments: it cannot tell whether a specific tenant was touched.

Why MFA did not help

Cloud Backup exists in every customer tenant as a service principal, with admin consent to read and write mail, files, chats and directory data. According to Huntress, the credential was a client assertion held in the vendor’s tenant: whoever holds it can authenticate as the application in every tenant that has consented to it. This is application access, with no user, device or MFA prompt involved. Microsoft considers it likely that previously granted permissions were abused, including Directory.ReadWrite.All.

The observed sequence

Huntress, Todyl and Microsoft, as reported by all the outlets, tie the activity to 144.172.64[.]128, an address belonging to a hosting provider:

• October 13–14: password spraying against four law firm tenants and scripted sign-in attempts (user agent curl/7.88.1), with no successful user sign-ins.
• October 15, 06:13–08:34 UTC: the Cloud Backup identity obtains Microsoft Graph tokens in tenants, in ascending ID order and a few seconds apart: a script working from a target list. Huntress confirmed unauthorized access in 162 tenants as of October 16; the figure of 173, attributed to Huntress in The Hacker News headline, does not appear on Huntress’s page according to ICT Security Magazine. Of nearly 1,000 Entra tenants with activity from that address, over 300 sign-ins succeeded; where the service principal was missing, access failed.
• Same day, second wave: targeted, apparently manual attempts against 16 organizations in the policy, national security, trade and critical minerals sectors, most of them not using ConnectWise products. They failed.

A single tenant shows the more serious case: about two and a half hours before the main wave, the ConnectWise Cloud Management - MS Teams app assigned itself the Global Administrator role and, within about five minutes, a Python script added new client secrets, valid until 2028, to two other applications: an MSP management tool and Huntress’s own application. The activity came from Azure’s internal network, not from the attacker’s address, and Huntress has not firmly tied it to the same operator. In about 50 tenants the Cloud Management apps assigned themselves directory roles, mostly Exchange Administrator, with the user agent of the vendor’s apps: Huntress thinks this may be ConnectWise automation, which the company has not confirmed. Microsoft reports Graph reconnaissance and attempts to add credentials; Todyl, across nine tenants, saw only sign-ins, with no directory changes.

Data theft is not confirmed: in the tenant it examined in detail, Huntress found no recorded mail or file access, but some Graph directory reads leave no trace in the audit logs.

Indicators and techniques

• IPs: 144.172.64[.]128, plus 144.172.64[.]99 and 144.172.64[.]60, added to the ConnectWise advisory on October 18–19;
• user agents: python-urllib/3.12, python-requests/2.31, python-requests/2.34.2, curl/7.88.1;
• Application IDs: Cloud Backup 506e08f9-6e9a-4da4-942b-a099a03644ae; Cloud Management 2399d300-6fca-4e6a-a686-399fefe75b83; MS Teams 24205314-2b89-4e07-a2a4-579e898a5640; Exchange Online b78f6a77-d4e5-46fb-87e5-d1648bd02519; MS Graph 0de14c77-b9b0-4137-9360-34878a929827; Partner Center 412dcf96-176d-4b3a-a1b0-4981ad66971e; SharePoint Online b2b55f5b-7758-4719-8d8f-88ae172e6bdb. In older tenants the Cloud Management apps may be named “SkyKick Cloud Manager”.

Huntress classifies the persistence as T1098.001 (Additional Cloud Credentials). In our reading, T1199 (Trusted Relationship), T1078.004 (Cloud Accounts), T1098.003 (Additional Cloud Roles) and T1110.003 (Password Spraying) are also relevant.

Impact for European and Italian companies

Many SMBs do not know which platform their MSP uses, and ConnectWise relies on MSPs to run the checks in the tenants. If you have entrusted Microsoft 365 to a provider, ask whether it uses, or has used in the past, Cloud Backup or SkyKick: sign-ins also succeeded in tenants without an active subscription. Managed ICT services fall within the NIS2 sectors: for entities in scope, tenant access through a supplier must also be assessed as a potentially reportable incident, and supply chain security is one of the required measures. And while the service is down, tenants are left without up-to-date backups.

What to do now

1. Preserve sign-in and audit logs before acting: with Entra ID Free they are kept for seven days.
2. Disable, without deleting, the seven applications among Entra’s enterprise applications, searching for them by Application ID. Do not re-enable them before ConnectWise issues instructions.
3. Check service principal sign-ins, not user sign-ins, filtering by the Cloud Backup ID and looking for the listed addresses from October 13 onwards.
4. Review the credentials of every application: secrets and certificates added since October 13 that nobody created must be removed. Disabling the ConnectWise apps does not remove keys added elsewhere.
5. Review roles and consents: admin roles assigned to apps, OAuth consent grants, federation trusts, recent Conditional Access changes; in the audit log, the “Add member to role”, “Update application” and “Add service principal credentials” events.
6. Check mail: forwarding, inbox and transport rules, delegations.
7. Account for tokens already issued: they remain valid until they expire, and revoking user sessions does not stop application access.
8. Reduce the attack surface: remove consent for third-party apps you no longer use and limit who holds the Application Administrator and Cloud Application Administrator roles, which can add credentials.

How ARXDOME helps

ARX Horizon lets you check the listed addresses against threat intelligence sources and recognizes them in the events the platform enriches, such as connections logged by firewalls. The Microsoft 365 tenant review described above still has to be done in the Entra ID admin center.

Last updated: 19 October 2026