Hijacked ConnectWise Cloud Backup Credential Used to Breach 173 Microsoft 365 Tenants
Cybersecurity researchers are warning of an active campaign in which unknown threat actors abused a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access across 173 partner and customer tenants. Managed service provider (MSP) security vendor Huntress first identified confirmed unauthorized sign-ins, with independent analysis from Todyl corroborating unauthorized authentication against Microsoft Graph using the same compromised application credentials.
Details
| Attribute | Value |
|---|---|
| Compromised service | ConnectWise Cloud Backup (formerly SkyKick) |
| Affected tenants confirmed | 173 partner/customer Microsoft 365 tenants |
| Discovered by | Huntress; corroborated by Todyl |
| Password-spraying window | October 13–14, 2026 (against four law firm tenants; no successful logins observed from spraying) |
| Confirmed unauthorized sign-ins | October 15, 2026, 06:13–08:34 UTC |
| Source IP observed | 144.172.64[.]128 |
| Privilege escalation vector | ConnectWise Cloud Management app for Microsoft Teams (App ID 24205314-2b89-4e07-a2a4-579e898a5640) |
| Detection pivot | Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae |
| Vendor response | ConnectWise closed Cloud Backup application access; reports no evidence of backup data compromise |
What Happened
ConnectWise Cloud Backup is a cloud backup and recovery application built for MSPs to protect customer Microsoft 365 and Google Workspace data. To do its job, the application is granted extensive, tenant-wide permissions — read access to mailboxes, OneDrive, SharePoint, Teams data, and directory information — across every customer tenant where it's installed. That breadth of access is precisely what made the compromise of its own credential so damaging.
Huntress security researcher Jonathan Semon described the signal that gave the campaign away: "The app's credential is in hostile hands... The actor moved through tenants in sorted GUID order, a few seconds apart, which points to a script working from a target list." That pattern — methodical, rapid, sequential tenant access rather than opportunistic probing — indicates the attackers were running an automated tool against a pre-compiled list of tenant identifiers once they had the stolen credential in hand.
Timeline and Attacker Tactics
Huntress traced an initial password-spraying attempt on October 13–14, 2026 against four law firm tenants specifically, though no successful user-level logins resulted from that activity. The confirmed unauthorized sign-ins using the compromised ConnectWise application credential occurred on October 15, 2026, between 06:13 and 08:34 UTC, originating from IP address 144.172.64[.]128.
Rather than relying on the Cloud Backup application's native functionality, the attackers authenticated using their own custom tooling to obtain Microsoft Graph access tokens — inheriting whatever permissions the compromised backup application already held in each tenant. In at least one affected tenant, the attackers went further: they used the ConnectWise Cloud Management app for Microsoft Teams (App ID 24205314-2b89-4e07-a2a4-579e898a5640) to self-escalate to Global Administrator, then executed a Python script that added new credentials to other privileged applications already present in the tenant — extending their access well beyond the original Cloud Backup foothold and creating additional persistence mechanisms that don't depend on the original compromised credential at all.
Huntress noted that some of the operations performed during this access "leave no audit trail," significantly complicating detection and full-scope incident response for affected organizations.
Impact Assessment
| Impact Area | Description |
|---|---|
| Data exposure | Mailbox, OneDrive, SharePoint, and Teams content readable across 173 tenants via inherited backup-app permissions |
| Privilege escalation | Global Administrator access achieved in at least one tenant via a second ConnectWise application |
| Persistence | New credentials added to other privileged applications, surviving revocation of the original compromised credential |
| Detection difficulty | Some attacker actions reportedly leave no audit trail in standard Microsoft 365 logging |
| Blast radius driver | The scale stems from the backup app's own broad, cross-tenant permission grant — a single compromised credential inherited access everywhere the app was installed |
Response
ConnectWise closed off Cloud Backup application access following the discovery and stated that it has "found no evidence that Cloud Backup partner backup data has been compromised." The company's public statement is limited to backup data specifically; it does not speak to the broader Microsoft Graph access, Global Administrator escalation, or added application credentials documented by Huntress and Todyl within affected tenants.
Recommendations
For MSPs and Affected Organizations
Treat the ConnectWise Cloud Backup application credential as compromised and disable the application in affected tenants until ConnectWise confirms credential rotation. Enable and retain Microsoft Graph activity logs, which captured activity that standard Entra sign-in logs may miss. Audit for any new application credentials or client secrets added since October 13, 2026, and review Entra audit logs for ConnectWise-related applications being granted directory roles they did not previously hold — particularly Global Administrator.
For Detection Teams
Filter Microsoft 365 sign-in and Graph activity logs for Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae and the ConnectWise Cloud Management Teams app (24205314-2b89-4e07-a2a4-579e898a5640) for suspicious activity outside expected backup operation windows. Treat sequential, rapid-fire access across many tenants in GUID order as a signature worth hunting for independently of this specific incident, since it indicates scripted, list-driven exploitation of a shared-service credential.
For All Organizations Using Third-Party M365 Integrations
This incident is a reminder that any application granted tenant-wide Graph permissions — backup tools, RMM platforms, compliance scanners — represents a single point of failure whose compromise inherits that application's full access footprint across every customer it serves. Regularly review which third-party applications hold Global Administrator or broad directory-role permissions, and favor least-privilege, conditional-access-scoped service accounts over blanket admin consent wherever the vendor supports it.
Key Takeaways
- A compromised ConnectWise Cloud Backup (formerly SkyKick) Microsoft 365 application credential was used to access 173 partner/customer tenants.
- Huntress discovered the activity; the attacker's sequential, GUID-ordered tenant access pattern indicates automated, list-driven exploitation rather than opportunistic probing.
- Confirmed sign-ins occurred October 15, 2026, 06:13–08:34 UTC from IP 144.172.64[.]128, following password-spraying attempts against four law firm tenants on October 13–14.
- In at least one tenant, attackers escalated to Global Administrator via a second ConnectWise application and planted new credentials on other privileged apps for persistence.
- ConnectWise closed Cloud Backup application access and reports no evidence of backup data compromise — a narrower claim than the Graph-level access and privilege escalation documented by researchers.
- Organizations should disable the affected application, audit for new application credentials since October 13, and review which third-party integrations hold broad Graph or directory-role permissions.