A criminal group has stolen a login key belonging to ConnectWise Cloud Backup, formerly SkyKick, a
backup service that many IT providers connect to their customers’ Microsoft 365 accounts. Because
that one key works in every customer that approved the service, the attacker signed in as the backup
app itself, with no password and no multi-factor prompt, and gained read and write access to email,
files, and Teams chats across hundreds of organisations. ConnectWise has shut the affected apps
down, but every organisation that used them should treat its data as exposed and check its Microsoft
365 tenant now.
1. Campaign Timeline
Huntress confirmed unauthorised, app-only sign-ins in 162 Microsoft 365 tenants between 13 and 16 October 2026, with
automated activity running from 144.172.64[.]128 and moving through tenants in sorted GUID order. Roughly 1,000
tenants showed sign-in activity from that address and more than 300 succeeded. Earlier, on 13 and 14 October, the same
address ran password spraying against four law firm tenants. ConnectWise disabled the seven affected app identities at
07:00 UTC on 17 October, revoked their certificates, and suspended Cloud Backup, SaaS Security, and Cloud
Management while remediation continues.
2. Attack Details
- Initial Access
The actor presented a valid client secret or assertion for the ConnectWise Cloud Backup app to Microsoft Entra ID
using the OAuth 2.0 client credentials flow. The credential lives in the vendor’s own tenant, so nothing a customer
did could have produced it.
- Token Issuance
Entra ID issued app-only Microsoft Graph access tokens in each tenant the actor targeted. No user signed in, so
multi-factor authentication and user conditional access did not apply.
- Privilege Escalation
In at least one tenant, the Cloud Management – MS Teams app granted itself the Global Administrator role, about
two and a half hours before the main sign-in wave.
- Persistence
Using that access, the actor added new client secrets to two other applications, including an MSP management
app, creating access paths that survive rotation of the original vendor credential (MITRE ATT&CK T1098.003)
- Collection and Sweep
App-only access reached every mailbox and site in each consented tenant. The actor repeated requests across
hundreds of tenants from the same address, and confirmed data theft cannot be ruled in or out because app
reads through Microsoft Graph leave no audit trail.
3. Adversary Toolkit
| Tool / Indicator | Type | Function |
| ConnectWise Cloud Backup (SkyKick) | OAuth app 506e08f9-6e9a-4da4-942b-a099a03644ae | Abused for app-only Graph tokens, giving tenant-wide mail, file, and Teams access. |
| ConnectWise Cloud Management | OAuth app 2399d300-6fca-4e6a-a686-399fef75b83 | ConnectWise management app flagged for review across all tenants. |
| Cloud Management – MS Teams | OAuth app 24205314-2b89-4e07-a2a4-579e898a5640 | Granted itself Global Administrator and added credentials to other apps in one tenant. |
| Cloud Management – Exchange Online | OAuth app b78f6a77-d4e5-46fb-87e5-d1648bd02519 | Assessed as abused to assign directory roles and reach Exchange Online. |
| Cloud Management – MS Graph | OAuth app 0de14c77-9b0-4137-9360-34878a929827 | Assessed as abused for Microsoft Graph access. |
| Cloud Management – Partner Center | OAuth app 412dcf96-176d-4b3a-a1b0-4981ad66971e | High-privilege app flagged for credential review. |
| Cloud Management – SharePoint Online | OAuth app b2b55f5b-7758-4719-8d8f-88ae172e6bdb | Assessed as abused to reach SharePoint Online content. |
4. Indicators of Compromise (IOCs)
TYPE- INDICATOR
IP- 144.172.64[.]128
IP- 144.172.64[.]99
IP- 144.172.64[.]60
5. Recommendations
- In Entra, Enterprise applications, find the seven ConnectWise and SkyKick app IDs listed above and set Enabled for users to sign-in to No. Do not delete them, as deleting removes the consent.
- Review every Enterprise application and App registration for client secrets or certificates added since 13 October that you did not create, and remove them. Strip any directory role a ConnectWise or SkyKick app granted itself, above all Global Administrator.
- Keep the apps disabled until ConnectWise confirms its shared credential is rotated, and check mailboxes for new forwarding, inbox or transport rules, and delegated access created during 13 to 16 October.
- In Entra, open Service principal sign-ins, not User sign-ins, filter on the app IDs, and flag any non-Microsoft source IP and Python or curl user agents. Enable Microsoft Graph activity logs (Entra ID P1 or P2) so app read activity becomes attributable.
- Monitor for the IOCs. Block the IOCs at their respective controls.
6. Sources
- https://www.connectwise.com/company/trust/advisories
- https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access
- https://www.todyl.com/blog/investigation-unauthorized-access-through-the-connectwise-cloud
backup-microsoft-365-app - https://x.com/msftsecintel/status/2111358888125878426
- https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-con
nectwise-supply-chain-attack/
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.