ConnectWise shut down customer access to its ConnectWise Cloud Backup service on October 17 after hackers used stolen vendor secrets to breach at least 173 Microsoft 365 customer tenants [1]. Managed service providers first noticed the illicit activity when scripted alerts flagged unexpected changes inside client systems. Security firm Huntress verified breaches in dozens of partner networks, while Microsoft confirmed that unauthorized authentication began days earlier from a hostile IP address. Because the backup tool relied on broad rights granted through Microsoft Entra ID, attackers didn’t need user logins to access corporate records, making multi-factor authentication (MFA) ineffective [2].
Inside SkyKick Cloud Backup
ConnectWise Cloud Backup, previously known as SkyKick Cloud Backup, helps IT teams protect records on cloud platforms like Microsoft 365 and Google Workspace. The tool uses an app identity in Microsoft Entra ID to read and copy files according to rights granted during setup, operating without human oversight [1]. User logins play no role. That means conditional access policies, password prompts, and MFA checks won’t stop rogue requests once secrets leak [2].
Security researchers at Todyl discovered that the intruder authenticated straight to Microsoft 365 as the backup app by presenting its stolen secret key [1]. Nicholas Koken, head of Detection Engineering at Todyl, said the connection simply inherited the app’s existing consent [2]. “Because the application already held broad, previously granted permissions in each tenant, those sign-ins gave the attacker the technical ability to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats,” Todyl said in its advisory. The granted rights also permitted full mailbox access through Exchange Web Services and the ability to restore data. In nine tenant intrusions analyzed by Todyl, researchers saw only sign-in activity, finding no evidence that attackers altered passwords or created rogue user accounts [1].
BleepingComputer reporter Ionut Ilascu reported that ConnectWise cut off app access at 05:01 UTC on October 17 while opening an inquiry into the illicit access. Later that day, Huntress verified partner intrusions in its own environment [1]. ConnectWise stated that it found no signs that partner backup archives were compromised. Existing cloud backup copies weren’t touched, but engineers kept services closed while working on fixes.
Automated Infiltration of Customer Tenants
Investigators from Microsoft, Huntress, and Todyl tracked the malicious authentication attempts to a single IP address: 144.172.64[.]128 [1]. Huntress security researcher Jonathan Semon said the compromised vendor credential was used to collect Microsoft Graph access tokens between 06:13 and 08:34 UTC on October 15, moving across customer accounts with steady speed. The intruder didn’t pause between requests. Instead, the scripted tool swept through customer tenants in sorted GUID order, hitting each cloud setup just seconds apart. Semon said this methodical progression showed that the script worked from a precompiled target list rather than picking targets by chance [2].
Huntress initially flagged 162 affected tenants, but the count grew to 173 customer environments as more logs arrived. Early intrusions suggested alphabetical prioritization, hitting victims starting with the letter A first. Security telemetry also indicated that the same hostile IP address had run password spraying campaigns against four separate law firm tenants on October 13 and October 14 without breaking in [2].
Forensic data revealed several scripted tools operating during the campaign. Authentication records captured three Python user agents: python-urllib/3.12, python-requests/2.31, and python-requests/2.34.2. Earlier scripted attempts on October 13 and 14 used curl/7.88.1 instead. Microsoft Threat Intelligence described the incident as an active supply-chain attack, noting that the threat actor abused pre-existing permissions including Directory.ReadWrite.All to inspect organization structures [1]. That broad level of access gave the intruder an unrestricted view of user accounts, groups, and sensitive directory relationships without generating typical sign-in warnings or administrative alerts [2].
Privilege Escalation in Microsoft Entra
Beyond simple data reads, Huntress discovered role modifications in nearly 50 customer tenants. ConnectWise Cloud Management service principals assigned themselves directory roles, most often Exchange Administrator. On Reddit, an administrator reported receiving an alert from Microsoft Privileged Identity Management (PIM) on October 15 after a SkyKick service principal granted itself Exchange Administrator rights [1].
In one customer tenant, researchers observed the attacker establish persistence in approximately five minutes [1]. The ConnectWise Cloud Management app for Microsoft Teams, carrying application ID 24205314-2b89-4e07-a2a4-579e898a5640, promoted itself to the Global Administrator role. It then launched a Python script using python-urllib/3.12 to modify two other trusted tools in the environment: an MSP management application and the Huntress Security Platform itself. Jonathan Semon said that planting secrets in management applications creates dangerous ripple effects. “Adding a credential to an MSP management application can extend access beyond the one tenant, because those applications are often consented into the MSP’s customers’ tenants,” Semon said [2].
This intrusion method differs fundamentally from user credential theft. While phishing rings focus on tricking staff into surrendering passwords, as seen during the Microsoft and Japan phishing network takedown, hijacking application identities bypasses identity barriers entirely [2]. Attackers use pre-approved API connections to plant backdoor credentials quietly.
Defending ConnectWise Cloud Backup Tenants
Defense teams need a different approach than standard user lockouts when handling app compromise. Both Microsoft and Huntress advised administrators to check the Service principal sign-ins tab in the Microsoft Entra Admin Center instead of the normal user log [2]. The default user tab won’t show service principal activity. Administrators should filter authentication events by the legitimate ConnectWise Cloud Backup application ID, 506e08f9-6e9a-4da4-942b-a099a03644ae, to spot unusual requests [1]. Normal traffic routes through Azure private IPv6 addresses, so any authentication originating from unexpected external IPs like 144.172.64[.]128 warrants immediate investigation [2].
Huntress urged administrators to disable all implicated ConnectWise applications right away [1]. A disabled app stops Azure from issuing new tokens, but issued tokens remain active for up to 90 minutes [2]. Revoking user sessions doesn’t kill application connections, so teams must audit and remove rogue credentials manually.
Nicholas Koken warned that tenants remain exposed until the vendor changes its application secret. “Any tenant where the app is still enabled stays exposed until ConnectWise rotates the credential,” Koken said [2]. Admins must act fast. IT teams should review older setups where apps might appear under SkyKick Cloud Manager, inspecting key application IDs like ConnectWise Cloud Management (2399d300-6fca-4e6a-a686-399fefe75b83), Teams (24205314-2b89-4e07-a2a4-579e898a5640), Exchange Online (b78f6a77-d4e5-46fb-87e5-d1648bd02519), and SharePoint Online (b2b55f5b-7758-4719-8d8f-88ae172e6bdb). Teams must also inspect secrets added in all tenant applications since October 13, 2026, to ensure no backdoors remain unrevoked [1].
Risks for Managed Service Providers
ConnectWise hasn’t shared a timeline for bringing the backup service back online. The company stated that existing customer archives remain safe and intact. Still, the shutdown leaves service providers without automated backup pipelines for Microsoft 365 and Google Workspace accounts, creating operational hurdles for daily IT routines [1].
The full scope of stolen customer data within the 173 breached tenants remains unconfirmed. Because backup tools carry wide permissions over mailboxes, chats, and document libraries, an intruder holding valid tokens can quietly inspect sensitive files without leaving user sign-in logs [2]. Standard endpoint and identity defenses often struggle to spot this activity because the requests look identical to legitimate software operations. According to findings from The Blue Report 2026, which tested defenses across 338 million simulations run in production environments, automated security tools stop only 37% of attacker actions once hackers possess valid credentials [1]. That makes early credential rotation and application pruning the main defense for protecting client data.
The incident illustrates how vulnerable cloud ecosystems become when vendor integrations receive broad consent [1]. A compromised vendor secret can endanger hundreds of downstream organizations. Administrators must treat third-party tools as direct security perimeters rather than background utilities that can be left unmonitored [2].
- ONLINE NEWS Ilascu, I. (2026, October 17). Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack. BleepingComputer. [Article Link]
- ONLINE NEWS The Hacker News. (2026, October 17). Hackers use compromised ConnectWise credential to sign in to 173 Microsoft 365 tenants. The Hacker News. [Article Link]
