ConnectWise Cloud Backup Breach Exposes 173 Microsoft 365 Tenants to Unauthorized Access

Cybersecurity researchers have warned of an active supply chain security incident involving ConnectWise Cloud Backup, formerly known as SkyKick Backup, after threat actors obtained access to a compromised vendor credential and used it to access customers’ Microsoft 365 environments.

According to Huntress, unauthorized sign-ins have been confirmed across 173 partner and customer tenants. The compromised credential belongs to the Cloud Backup application, which has extensive permissions to access Microsoft 365 mailboxes, OneDrive, SharePoint, Teams, and directory information across connected tenants.

The attackers reportedly used the compromised application identity to obtain Microsoft Graph access tokens, allowing them to inherit permissions already granted to the backup service.

Attackers Exploit Trusted Application Permissions

Huntress observed suspicious authentication activity originating from the IP address 144.172.64[.]128 on October 15, 2026, between 06:13 and 08:34 UTC. Investigators said the activity moved through customer tenants in an orderly sequence, suggesting automated targeting.

The same IP address was also associated with password-spraying attempts against four law firm tenants on October 13 and 14. Huntress reported that it had not observed successful user sign-ins from those attempts in its telemetry.

The incident goes beyond unauthorized access to backup data. In at least one partner tenant, investigators identified a separate ConnectWise application that assigned itself Global Administrator privileges and added new credentials to other trusted applications.

The ConnectWise Cloud Management application for Microsoft Teams, identified by application ID 24205314-2b89-4e07-a2a4-579e898a5640, reportedly added itself to the Global Administrator role. It then used a Python script to modify two other applications, an MSP management application and the Huntress Security Platform, by adding new client secrets.

Because these applications may already have privileged access across customer environments, the newly added credentials could potentially extend an attacker’s access beyond a single tenant.

Microsoft Confirms Active Supply Chain Attack

Microsoft said it is tracking an active supply chain attack involving the trusted OAuth application used by ConnectWise Cloud Backup.

The attackers allegedly abused permissions previously granted to the application, including highly privileged permissions such as Directory.ReadWrite.All.

Microsoft observed successful service principal authentication from 144.172.64[.]128 on October 15, followed by Microsoft Graph API reconnaissance and attempts to add credentials to related service principals. These actions could allow the attackers to maintain direct access to affected tenants.

Todyl independently reported unauthorized authentication to Microsoft Graph using the ConnectWise Cloud Backup application. The access inherited the application's existing permissions, which included access to email and attachments, OneDrive and SharePoint files, and Teams chats.

ConnectWise Disables Cloud Backup Application Access

ConnectWise has disabled Cloud Backup application access while its investigation and remediation efforts continue. The company said it had found no evidence that Cloud Backup partner backup data had been compromised.

However, investigators warned that revoking user sessions alone does not eliminate the risk because the access relies on application credentials and service principal tokens. Disabling the application prevents new tokens from being issued in the affected tenant, but previously issued tokens may remain valid for up to 90 minutes.

Organizations that continue to have the application enabled may remain exposed until the compromised credentials are rotated and access is secured.

Indicators of Compromise

Security teams should review Microsoft Entra ID logs and investigate suspicious activity associated with the following indicators.

  • Suspicious IP address: 144.172.64[.]128
  • ConnectWise Cloud Backup application ID: 506e08f9-6e9a-4da4-942b-a099a03644ae
  • ConnectWise Cloud Management application ID: 2399d300-6fca-4e6a-a686-399fefe75b83
  • ConnectWise Cloud Management for Microsoft Teams: 24205314-2b89-4e07-a2a4-579e898a5640
  • ConnectWise Cloud Management for Exchange Online: b78f6a77-d4e5-46fb-87e5-d1648bd02519
  • ConnectWise Cloud Management for Microsoft Graph: 0de14c77-b9b0-4137-9360-34878a929827
  • ConnectWise Cloud Management for Partner Center: 412dcf96-176d-4b3a-a1b0-4981ad66971e
  • ConnectWise Cloud Management for SharePoint Online: b2b55f5b-7758-4719-8d8f-88ae172e6bdb

Administrators should navigate to Microsoft Entra Admin Center → Monitoring → Sign-in logs → Service principal sign-ins and filter by the Cloud Backup application ID. The standard User sign-ins tab will not show the relevant service principal activity.

Investigators recommend reviewing sign-ins from unfamiliar IP addresses, changes to application credentials, OAuth grant activity, and any unexpected attempts by ConnectWise applications to assign themselves directory roles.

Organizations using ConnectWise Cloud Backup should take immediate steps to investigate and reduce potential exposure:

  • Disable the affected application in each tenant until ConnectWise confirms that credentials have been rotated and access is safe to restore.
  • Review service principal sign-in logs for authentication from 144.172.64[.]128 and other unexpected IP addresses.
  • Audit Microsoft Entra ID logs for newly created client secrets, modified OAuth permissions, and unexpected Global Administrator role assignments.
  • Enable and review Microsoft Graph activity logging where available.
  • Investigate activity involving ConnectWise and SkyKick application identities, including changes to other trusted applications.
  • Coordinate with ConnectWise and the organization's managed service provider before restoring application access.

Huntress also noted a possible alphabetical targeting pattern in the observed activity, but stressed that all tenants should be scrutinized rather than relying on this pattern to determine priority.

The incident highlights the risks associated with trusted third-party applications that hold broad permissions across multiple customer environments. A single compromised vendor credential can potentially provide attackers with access to sensitive data across many organizations, making application identity monitoring and rapid credential rotation critical components of Microsoft 365 security.