ConnectWise Cloud Backup supply chain attack compromises Microsoft 365 tenants via OAuth abuse

1. Executive summary

Attackers used a stolen credential belonging to the ConnectWise Cloud Backup application (formerly SkyKick) to authenticate as that application into customer Microsoft 365 tenants and obtain Microsoft Graph tokens with the permissions each tenant had already granted the app. Huntress confirmed unauthorised sign-ins in 162 tenants, and Microsoft Threat Intelligence is tracking the activity as a supply chain attack involving a trusted OAuth application. ConnectWise has suspended Cloud Backup, SaaS Security and Cloud Management, revoked the certificates used for affected application connections, and disabled seven application identities. No CVE has been assigned and no severity score applies; this is abuse of legitimate application permissions, not a software flaw. The exposure for EMEA financial services sits with any firm whose Microsoft 365 tenant has consented to the ConnectWise Cloud Backup service principal, directly or through an MSP, because the stolen credential worked against every tenant where the app was installed and the attacker added long-lived credentials to other applications to keep access after the vendor shutdown.

2. Regulatory framing

3. Technical analysis & attack chain

ConnectWise Cloud Backup is a multitenant backup and recovery service that MSPs use to protect Microsoft 365 and Google Workspace data. To copy mailboxes, OneDrive, SharePoint, Teams and directory data, an administrator in each customer tenant grants the app broad read and write permissions through Microsoft Entra ID. The app then exists in that tenant as an application identity (a service principal) and can read and write data without any person signing in. The credential that was stolen is a client assertion held in ConnectWise's own tenant; nothing a customer did in its environment could have produced the authentication Huntress observed.

Confirmed sequence:

1. On 13 and 14 October, the address 144.172.64[.]128 was used for password spraying against four law firm tenants. Huntress saw scripted OAuth2 token requests with User-Agent curl/7.88.1 from datacenter infrastructure. Two accounts were locked out by smart lockout and Huntress saw no successful user sign-ins from that IP in its telemetry.
2. On 15 October, from 01:58 UTC, in roughly 50 tenants monitored by Huntress, service principals for ConnectWise Cloud Management apps (Exchange Online, Microsoft Teams, Microsoft Graph) assigned themselves directory roles, mostly Exchange Administrator. The User-Agent on these events was kiota-dotnet, the one ConnectWise's own apps use, which points to vendor automation; ConnectWise has not confirmed this.
3. Between 03:44 and 03:49 UTC on 15 October, in one customer tenant, the ConnectWise Cloud Management app for Microsoft Teams (application ID 24205314-2b89-4e07-a2a4-579e898a5640) added itself to the Global Administrator role, then ran a Python script (User-Agent Python-urllib/3.12) that added new client secrets to two other applications in the tenant: an MSP management application and Huntress's own application (Huntress Security Platform). A follow-up attempt to add a certificate failed. The new secrets were set to expire in 2028.
4. Between 06:13 and 08:34 UTC on 15 October, the Cloud Backup application identity signed in to customer tenants from 144.172.64[.]128, a hosting provider address rather than the Azure private IP space legitimate traffic uses, and received Microsoft Graph access tokens. The actor moved through tenants in sorted GUID order, a few seconds apart, which points to a script working from a target list.
5. Microsoft detected broad successful principal authentication on 15 October and observed Microsoft Graph API reconnaissance and attempts to add additional credentials to maintain access as a backdoor.
6. Huntress confirmed unauthorised sign-ins in 162 tenants. It also recorded sign-in attempts against nearly 1,000 Microsoft 365 accounts, more than 300 of them successful, with the wider activity coming from Microsoft's internal cloud infrastructure rather than the attacker's hosting address.
7. ConnectWise confirmed unauthorised access to application identities in the Cloud Backup environment, suspended Cloud Backup, SaaS Security and Cloud Management, revoked certificates used for affected application connections across all users, disabled seven application identities, and stated that all shared credentials previously used for Cloud Backup are no longer valid.

The permissions at issue are the ones customers granted. Microsoft assesses the actor likely abused permissions previously granted by customers, including highly elevated permissions such as Directory.ReadWrite.All. Huntress notes that an application able to assign directory roles can make itself a Global Administrator, and an administrator can add credentials to other applications, create new applications and grant them permissions, reset passwords and authentication methods, and change Conditional Access policies. The attacker's access therefore extended beyond the backup data itself.

A second wave targeted systems in the policy, national security, trade and critical mineral sectors. Most of those attempts failed because the tenants did not have the relevant ConnectWise service principal installed, so the application was not present to authenticate.

Two points of uncertainty. First, the role assignments in roughly 50 tenants carry ConnectWise's own automation signature and may be vendor behaviour rather than attacker action; ConnectWise has not confirmed either way. Second, the 162-tenant figure is Huntress's confirmed count and the 300-plus successful sign-ins is Huntress telemetry; the true population is every tenant where the app was consented, which neither Huntress nor ConnectWise can enumerate. ConnectWise states it has no visibility into partner and customer environments and cannot determine whether a particular customer's Microsoft 365 environment was breached. The technical detail above rests largely on the Huntress blog post, corroborated on the core facts (stolen Cloud Backup credential, 144.172.64[.]128, Graph token issuance, supply chain framing) by Microsoft's statements as reported and by ConnectWise's own advisories. The single-tenant secret-planting detail and the 2028 expiry are Huntress-only.

No malware, payload, command-and-control channel or exploit is involved. The attacker used the application's own authentication path with its own tooling.

4. Mitigation & containment

P1 within 24 hours

• Enumerate every enterprise application in each Microsoft 365 tenant and identify the ConnectWise Cloud Backup service principal and the Cloud Management service principals (Exchange Online, Microsoft Teams, Microsoft Graph). Record which tenants consented and under what permissions.
• Pull Entra ID sign-in logs for application (service principal) authentication and search for the address 144.172.64[.]128 and for any authentication by the Cloud Backup application from outside Azure private IP space. Preserve the logs before any retention window closes; ConnectWise's first recommendation is to preserve sign-in and audit records while containing.
• Review credentials on all Microsoft 365 applications, not only the ConnectWise ones. Disabling the abused apps does not remove credentials already added. For each app registration, list key credentials and password credentials, and revoke any client secret or certificate you cannot account for. Huntress observed secrets with a 2028 expiry planted on an MSP management application and on the Huntress Security Platform application.
• Review directory role assignments, particularly Global Administrator and Exchange Administrator, and remove any held by an application identity that should not have them.
• Check for unauthorised mailbox forwarding, inbox rules and delegated mailbox access across all mailboxes the app could reach.
• Review federation trusts and any identity provider configuration changed during the window.

P2 within 72 hours

• Rotate credentials for every application the ConnectWise service principals could reach, including single-tenant applications unique to individual customers.
• Review Conditional Access policies for changes made between 15 and 18 October, and confirm policies still apply to application identities as intended.
• Where the firm uses an MSP, obtain written confirmation of which ConnectWise products the MSP deploys into the firm's tenant and the results of the MSP's own log review. The firm cannot rely on ConnectWise for this; ConnectWise has said it cannot determine whether a given customer environment was breached.
• Treat backup coverage as degraded while Cloud Backup is suspended. End users cannot back up, access archives or restore data, and ConnectWise has given no restoration timeline. Confirm alternative backup coverage for Microsoft 365 data or accept and document the gap.

P3 within 7 days

• Reduce standing application permissions. Where the backup application does not need Directory.ReadWrite.All, remove it and re-consent with the minimum the service requires.
• Add detection coverage for application-identity authentication from non-Azure address space and for client secrets added to existing app registrations (see §6).
• Review contract terms with the MSP and with ConnectWise against DORA Art. 30 expectations for provider-side incident notification and cooperation.

5. Indicators of compromise

ipv4  144.172.64[.]128
ipv4  142.172.64[.]128

The two addresses differ by one octet. Every source that quotes Huntress or ConnectWise uses 144.172.64[.]128; the Cybersecurity Dive article attributes 142.172.64[.]128 to Microsoft. Huntress states ConnectWise confirmed the IP it published is associated with unauthorised activity. Verify the Microsoft figure before blocking on it; the 144 address is the corroborated one.

No file hashes, domains or URLs are available in the source material.

Behavioural indicators

6. Detection

The artefacts available are the application IDs, the user agents and the audit-log behaviours. A YARA rule is not appropriate here: there is no file to scan. The Sigma rule below targets Entra ID audit and sign-in events.

title: ConnectWise Cloud Backup Application Credential Abuse
id: 7c1f4a2e-9b3d-4e6a-8f21-5d0c9a7b3e14
status: experimental
description: Detects application-identity authentication and credential planting consistent with the ConnectWise Cloud Backup supply chain attack of October 2026.
author: Adverse Trace
date: 2026-10-20
references:

  - https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access
  - https://therecord.media/connectwise-suspends-cloud-backup-service-supply-chain-attack
logsource:
  product: azure
  service: signinlogs
detection:
  selection_ip:
    IPAddress: '144.172.64.128'
  selection_app:
    AppId: '506e08f9-6e9a-4da4-942b-a099a03644ae'
  selection_teams_app:
    AppId: '24205314-2b89-4e07-a2a4-579e898a5640'
  selection_ua:
    UserAgent|contains:

      - 'curl/7.88.1'
      - 'Python-urllib/3.12'
  condition: selection_ip or selection_app or selection_teams_app or selection_ua
falsepositives:

  - Legitimate ConnectWise Cloud Backup operations from Azure address space (the selection_app branch will fire on normal backup traffic; scope it to non-Azure source IPs before enabling)
level: high

title: Client Secret Added to Existing Microsoft 365 Application
id: 2e8b6d10-4a7c-4f39-b5e2-8c1d6f0a9b47
status: experimental
description: Detects new password credentials added to existing app registrations, the persistence method observed in the ConnectWise Cloud Backup incident.
author: Adverse Trace
date: 2026-10-20
references:

  - https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    OperationName: 'Update application'
    ModifiedProperties|contains: 'PasswordCredentials'
  condition: selection
falsepositives:

  - Scheduled credential rotation by application owners
level: medium

7. Sources

• Huntress, "ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks", https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access, published 16 October 2026.
• The Record (Recorded Future), "ConnectWise suspends Cloud Backup service after supply chain attack", https://therecord.media/connectwise-suspends-cloud-backup-service-supply-chain-attack, October 2026.
• Help Net Security, "ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access", https://www.helpnetsecurity.com/2026/10/19/connectwise-cloud-backup-suspended-security-incident/, 19 October 2026.
• The Hacker News, "ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants", https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html, October 2026.
• The Hacker News, "Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants", https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html, October 2026.
• The Register, "ConnectWise turns off its SaaS-y backup, security, and management services to probe security SNAFU", https://www.theregister.com/security/2026/10/19/connectwise-turns-off-its-saas-y-backup-security-and-management-services-to-probe-security-snafu/5303758, 19 October 2026.
• Cybersecurity Dive, "ConnectWise suspends Cloud Backup service as hacker targets Microsoft 365 users", https://www.cybersecuritydive.com/news/connecwise-suspends-cloud-backup-hacker-microsoft-365/833345/, 19 October 2026.

8. Adverse Trace position

No CVE has been assigned and no CVSS score or CISA KEV status applies; the incident is abuse of legitimately granted OAuth permissions, and we do not assign a vulnerability severity to it. The operational severity is high for any EMEA financial services firm whose tenant has consented to the ConnectWise Cloud Backup service principal, because the stolen credential worked against every such tenant, the attacker planted credentials with a 2028 expiry that survive the vendor shutdown, and ConnectWise cannot tell customers whether their environment was accessed. Attribution is unconfirmed: no actor has been named by ConnectWise, Microsoft or Huntress, and no MITRE ATT&CK profile maps to this activity. The technical account rests mainly on Huntress, with Microsoft and ConnectWise corroborating the core facts; the secret-planting detail and the 2028 expiry are single-sourced to Huntress and should be verified against the firm's own audit logs before enforcement. The 142.172.64[.]128 address appears in one outlet only and conflicts with every other source; we will seek Microsoft's original post to resolve it. Adverse Trace will monitor ConnectWise's restoration advisories and any Microsoft attribution update, and will reissue this note if either changes the containment picture. Clients should treat the P1 log review and credential audit in §4 as the immediate action and report back their tenant findings so we can correlate exposure across the client base.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.