Major Supply Chain Attack Exploits Compromised ConnectWise Cloud Backup Credentials to Target Microsoft 365 Environments

Cybersecurity researchers are sounding the alarm over an active and sophisticated supply chain campaign in which unknown threat actors have abused compromised Microsoft 365 credentials belonging to ConnectWise Cloud Backup, formerly known as SkyKick. The breach has allowed unauthorized parties to gain deep, high-level access to customer Microsoft 365 environments across numerous organizations, prompting swift defensive reactions from major security firms and technology giants alike.

ConnectWise Cloud Backup is a widely utilized cloud-based backup and recovery service engineered specifically for managed service providers, commonly known as MSPs. The platform is designed to secure critical client data residing within Microsoft 365 and Google Workspace applications. To fulfill its operational functions, the application requires and is granted sweeping, comprehensive access permissions to mailboxes, OneDrive, SharePoint, Microsoft Teams, and directory data across every tenant where it has been deployed.

According to threat intelligence firm Huntress, researchers have confirmed unauthorized sign-ins within 173 partner and customer tenants using the compromised vendor credentials. The security incident impacts any organization that currently has the application installed, as the stolen credentials remain functionally valid against every individual tenant where the app has received prior consent.

Detailing the mechanics of the intrusion, Huntress security researcher Jonathan Semon noted that the application’s credentials are definitively in hostile hands. The unauthorized access was leveraged to successfully acquire Microsoft Graph tokens within targeted customer tenants originating from a specific IP address—144.172.64[.]128—on October 15, between 06:13 and 08:34 UTC. Telemetry data indicates that the adversary moved systematically through tenant environments in sorted GUID order, spaced mere seconds apart, which strongly points to an automated script executing commands from a predefined target list.

During the observed operations, the threat actor authenticated to the application using custom tooling in a manner mimicking the legitimate backup service, successfully obtaining tokens with the application’s existing permission set. Because the backup app inherently possesses extensive privileges regarding customer data, an attacker holding these tokens gains the operational ability to read sensitive mailboxes, corporate files, and directory information with the exact same reach as the authorized backup utility. Furthermore, Huntress noted that the identical IP address had engaged in preceding password-spraying campaigns targeting four separate law firm tenants on October 13 and October 14, 2026, though telemetry did not record successful user sign-ins from those specific attempts.

The scope of the risk extends far beyond standard data viewing capabilities. In at least one inspected partner tenant, cybersecurity investigators discovered a separate ConnectWise application automatically assigning itself Global Administrator privileges and actively appending new credentials to other trusted applications within the environment. This behavior establishes a hazardous pathway to adjacent privileged applications across customer environments, effectively multiplying the risk vector far beyond the initial vendor account.

Explaining this escalation, Semon detailed that the ConnectWise Cloud Management app for Microsoft Teams added itself directly to the Global Administrator directory role. Following this elevation, it executed a Python script utilizing a standard urllib user-agent that modified two distinct applications within the tenant: an internal MSP management application and the Huntress Security Platform itself, thereby injecting new client secrets into both platforms.

Because these targeted applications represent trusted and privileged tools within an IT infrastructure, adding unauthorized credentials to an MSP management application can easily extend compromise well beyond a single tenant, as such management tools are frequently consented into the administrative boundaries of an MSP’s entire client base. Securing a credential on a security tool’s application simultaneously grants the holder whatever broad permissions that designated security software is legally permitted to execute.

Independent analysis conducted by Todyl reinforced these findings, confirming that unauthorized entities successfully authenticated to Microsoft Graph posing as the ConnectWise Cloud Backup application. Nicholas Koken, Todyl’s head of Detection Engineering, explained that the unauthorized access seamlessly inherited the application’s pre-existing consent parameters. This includes full read and write access to email messages and attachments through Exchange Web Services, direct file access across OneDrive and SharePoint repositories, visibility into Teams chats, and the underlying capability to execute data restoration procedures.

Todyl’s investigation emphasized that simply revoking standard user sessions is insufficient to sever this specific vector of access. Disabling the application within an individual tenant successfully prevents the issuance of new tokens locally, but tokens that have already been issued remain cryptographically valid for up to 90 minutes. Consequently, any tenant where the application remains active stays continuously exposed until the vendor successfully executes a full rotation of the compromised credentials.

In swift response to the mounting crisis, ConnectWise took immediate operational steps to suspend Cloud Backup application access until further notice. The company stated that its ongoing investigation has found no initial evidence indicating that core Cloud Backup partner data has been compromised. Concurrently, the firm began distributing advisories to help partners identify potential indicators of compromise within their environments.

Industry experts emphasize the inherent risks associated with high-privilege utility applications. Because backup services require broad, structural access to function effectively, any malicious actor who manages to leverage their credentials effectively inherits that elevated privilege level across every connected tenant. Depending on the exact permission configurations active within a given tenant, this exposure can encompass private corporate communications, sensitive cloud documents, collaboration data, and internal directory information belonging to end clients. Because certain administrative actions, such as directory reads executed through Microsoft Graph, leave minimal or no standard audit trails, security analysts strongly recommend proactive containment measures rather than waiting for explicit proof of data exfiltration.

Affected users are strongly advised to disable the problematic application immediately until ConnectWise verifies that all backend credentials have been securely reset. Organizations should also enable detailed Microsoft Graph activity logs, audit directory environments for any unauthorized credentials added since October 13, 2026, and thoroughly inspect Microsoft Entra ID audit logs to check whether ConnectWise or SkyKick applications have improperly added themselves to sensitive directory administrative roles.

This incident unfolds against a broader backdrop of sophisticated supply chain threats targeting the software ecosystem. Recently, threat intelligence teams from Google, including Mandiant and the Google Threat Intelligence Group, alongside the ManageEngine Threat Analysis Lab, detailed an ephemeral supply chain tampering campaign. That operation targeted the update infrastructure of AOMEI Backupper—a widely used disk cloning, data backup, and disaster recovery utility—to covertly bypass traditional endpoint security defenses and distribute advanced malware payloads such as CROSSROAD and SHINYROAD.

The AOMEI campaign, attributed to a previously undocumented threat cluster tracked as UNC7017, involved short-burst configuration tampering against origin update servers. Each active tampering window lasted for only five to ten minutes before the servers reverted to authentic versions, tricking software installations into downloading malicious packages from attacker-controlled infrastructure. This activity impacted organizations across IT services, telecommunications, and higher education globally.

Addressing the ConnectWise incident directly, Microsoft confirmed via social media channels that it is tracking an active supply chain attack wherein threat actors compromised the trusted OAuth application tied to ConnectWise Cloud Backup to harvest access tokens across multiple customer tenants. Microsoft noted that the adversary capitalized on pre-existing high-privilege permissions, such as Directory.ReadWrite.All, which had been granted by customers during initial deployment. Service principal authentications originating from the primary suspicious IP address were observed driving Microsoft Graph API reconnaissance and attempting to inject persistent backdoor credentials into target tenants.

As investigations continue across multiple cybersecurity firms and technology vendors, analysts have noted potential behavioral patterns in early targeting phases, suggesting an affinity for alphabetical sequencing among initial victims. Security teams are urged to maintain heightened vigilance, review all external service principal sign-ins, and apply recommended hardening measures across all Microsoft 365 environments.