DEV Community

Anoymask
Anoymask

Posted on

ConnectWise Cloud Backup Breach: Stolen App Credentials Used to Compromise Microsoft 365 Tenants

#security #threatintel

1. Basic Information

Credentials for a multi-tenant application with broad Microsoft Graph permissions were compromised, and Huntress confirmed unauthorized authentication across 162 tenants. In one thoroughly investigated tenant, Global Administrator assignment and persistence via additional credentials were established.

2. Executive Summary

ConnectWise Cloud Backup app credentials were abused to gain unauthorized access to Microsoft 365 through app-only authentication, which does not involve a user sign-in or user MFA. In at least one tenant, the Cloud Management - MS Teams app assigned itself Global Administrator and added client secrets to other apps.

3. Attack Flow

Cloud Backup mass authentication and the privilege escalation and persistence observed by Huntress in a single tenant are organized as independent observations. The latter occurred between 2026-10-15 03:44 and 03:49 UTC, prior to the mass authentication window (06:13 to 08:34 UTC on the same day). It has not been confirmed as part of the same operator's actions, nor does it indicate that privilege escalation or persistence occurred across all tenants.

Category Observation Time Window (UTC) Abused Application Confirmed Activity and Scope
Attack Path A 2026-10-15 06:13 - 08:34 ConnectWise Cloud Backup (formerly SkyKick) App-only authentication using the OAuth 2.0 client credentials flow and acquisition of tokens for Microsoft Graph. Todyl found no evidence of bulk copying in the tenants it investigated
Attack Path B 2026-10-15 03:44 - 03:49 (Role assignment and credential addition) ConnectWise Cloud Management - MS Teams Assignment of Global Administrator to itself and addition of new client secrets to the MSP management app and Huntress app. Seven subsequent sign-ins using the added Huntress credentials were also verified (in the thoroughly investigated tenant)

The scale and aggregation timing of each observation are distinguished in Section 9. Approximately 1,000 tenants and over 300 successful sign-in records associated with the IP address linked to unauthorized activity should not be treated as results confined to this table's Cloud Backup time window.

Attack Path A: Cross-Tenant Authentication via Cloud Backup App Credentials

  1. An attacker obtains vendor-managed Cloud Backup app credentials. The exact leakage vector remains unconfirmed.
  2. The attacker uses the OAuth 2.0 client credentials flow to authenticate to Microsoft Entra ID as an application within the target tenant.
  3. Entra ID issues an app-only access token for Microsoft Graph. No user signs in during this flow, so user MFA does not apply.
  4. The attacker automates this process across target tenants, using the permissions already consented to the Cloud Backup app for email, OneDrive, SharePoint, Teams, and other services.
  5. In the tenants investigated by Todyl, no evidence supporting bulk data copying was found. However, due to audit log limitations, the absence of records does not rule out data access.

Attack Path B: Privilege Escalation and Persistence Observed in One Tenant

  1. The ConnectWise Cloud Management - MS Teams app adds itself to the Global Administrator role.
  2. The same app adds new client secrets to the MSP management app and the Huntress app.
  3. The added Huntress app credentials are used for seven sign-ins within a short timeframe.
  4. Even if the original app is disabled, credentials added to other apps remain valid, requiring individual deletion.

4. Attacker Positioning and Execution Location

  • External attackers who possess vendor-managed multi-tenant app credentials and perform app-only authentication to Microsoft 365 from the internet.
  • Operations in the separately verified tenant utilized Microsoft Graph, Entra app management capabilities, and directory roles. The chronological progression from Cloud Backup mass authentication to this activity has not been confirmed.

5. Visibility for Victims and Administrators

  • Victims and Users: Since standard user logins or MFA prompts do not occur, end users may notice no anomalies.
  • Administrators: Appears in logs as service principal sign-ins, suspicious IPv4 addresses or Python user-agents associated with Cloud Backup/SkyKick apps, directory role assignments, and added client secrets to existing applications.

6. Success and Failure Conditions

Success Conditions

  • ConnectWise Cloud Backup or related Cloud Management applications must be consented and registered in the target tenant.
  • The attacker must be able to use valid vendor-managed client secrets or certificates.
  • Data operations require specific Microsoft Graph permissions granted to the target app, while role assignments and credential additions to other apps require separate respective administrative privileges. Successful authentication alone does not imply that these subsequent operations succeeded.

Failure Conditions and Mitigations

  • ConnectWise disabled the seven affected application identities at 07:00 UTC on 2026-10-17. Customers should also verify the status of each enterprise application using the official Application ID list and maintain the disabled state until official recovery instructions are released. Vendor-side measures alone do not imply that local settings across all customer tenants changed.
  • Minimize permissions granted to apps and disable unused old SkyKick/ConnectWise apps.
  • Audit and delete improperly added client secrets and certificates across all applications. Disabling an app stops the issuance of new tokens, but previously issued tokens may remain usable until expiration. Furthermore, revoking user sessions alone does not stop app-only access.

7. Impact Upon Success

  • Within the scope of permissions actually granted to each app, read and write access to emails, attachments, OneDrive/SharePoint files, Teams chats, and directory data may be abused.
  • Persistence is established through Global Administrator assignment and credential additions to other apps, potentially expanding the impact through the MSP channel.
  • While Cloud Backup is suspended, new backups and restoration capabilities are interrupted.

8. Observable Logs

The following items are candidates for investigation within your organization. Availability depends on licenses, log settings, and retention periods.

  • Email: This is not an attack originating from user emails. Check Exchange audit logs for mailbox access by the target Application ID, though identifying the source IP may require additional logs.
  • Proxy / SWG / DNS: Inference: Authentication requests sent from outside the organization to Microsoft 365 may not traverse the customer's proxy, SWG, or DNS infrastructure. Authentication source IPs and user-agents should be investigated primarily via Entra records.
  • Endpoint / EDR: Inference: The primary activity environment for this incident is Microsoft 365. Related credentials and scripts on MSP management infrastructure or automation endpoints are supplementary investigation targets, and do not mean that those endpoints themselves were confirmed to be compromised.
  • Identity / IdP: Search service principal sign-ins for Application IDs 506e08f9-6e9a-4da4-942b-a099a03644ae, 24205314-2b89-4e07-a2a4-579e898a5640, and related IDs from the official list. Verify source IP 144.172.64[.]128, user-agents Python-urllib/3.12 and python-requests/2.31 if recorded, and authentication results. Do not confirm a compromise based solely on IP addresses or user-agents, and do not rule out Azure-internal sources.
  • SaaS / Cloud: Investigate role assignments and credential additions using Entra audit logs, and check operations on email, files, and Teams using available Unified Audit Logs. Pre-collected MicrosoftGraphActivityLogs are records for examining Graph API requests and sources, which are distinct from token issuance events themselves. Full visibility of read activities may not always be available.
  • Network: Inference: Standard customer network logs may not capture external authentication to Microsoft 365 or Graph API usage. Correlate Entra authentication records and collected Graph API requests using app IDs, timestamps, sources, and available correlation IDs.

9. Attack Success Assessment

Confirmed in Public Information

  • Malware Execution or Successful Authentication Confirmed: Huntress confirmed unauthorized app authentication across 162 tenants as of 2026-10-16 19:00 UTC. The 2026-10-17 update confirmed activity across approximately 1,000 tenants and over 300 successful sign-in records associated with the IP address linked to unauthorized activity, but the latter does not imply an equivalent number of compromised tenants. Data exfiltration remains unconfirmed. Scope: Microsoft 365 authentication for ConnectWise Cloud Backup / related apps
  • Subsequent Compromise Confirmed: In one tenant, the Cloud Management - MS Teams app acquired Global Administrator privileges and added client secrets to two other apps, with the added Huntress credentials used for seven sign-ins. Data reading has not been confirmed. Scope: One customer tenant thoroughly investigated by Huntress

Separate authentication success, data access, privilege escalation, and persistence stage by stage, and do not treat successful sign-in counts directly as the number of compromised tenants.

10. Investigation Playbook

  • Investigation Starting Point: Start with the usage status of ConnectWise Cloud Backup/SkyKick, sign-ins for target Application IDs, suspicious IPs, Python user-agents, and app credential changes.
  • Initial Review: Verify across all tenants whether target apps exist, their enabled status, granted permissions, directory roles, and service principal sign-ins since October 13.
  • Endpoint and Server Investigation: Check whether client secrets or certificates for target apps are stored or used on MSP management infrastructure or automation endpoints, and preserve related scripts and credentials.
  • Authentication and Cloud Investigation: Check Entra audit logs for role assignments, OAuth consent, and service principal credential additions, and trace API-level sources using MicrosoftGraphActivityLogs if available.
  • Subsequent Operations: Investigate sign-ins by other apps holding added client secrets, reading of emails, files, and Teams, and MSP cross-tenant access.
  • Containment: Disable rather than delete target apps, and remove unauthorized client secrets, certificates, and roles. Verify the validity period of issued tokens and access paths remaining in other apps, and continue monitoring until recovery instructions are released. Revoking user sessions does not replace invalidating app-only tokens.
  • Decision Categories: Evaluate authentication attempts, app-only token issuance, data access, role assignments, added credentials, and re-authentication in separate apps independently.

11. Defense and Detection Ideas

  • Single Event: Treat the assignment of Global Administrator to a high-privilege service principal or the addition of new client secrets to existing security/MSP apps as high-priority alerts.
  • Chronological Correlation: Correlate role assignment within a tenant -> credential addition to another app -> sign-in using the added credentials. Investigate Cloud Backup mass authentication and subsequent API requests separately, avoiding unverified chronological connections between the two observations.
  • Threat Hunting: Audit all tenants for ConnectWise publisher apps including legacy SkyKick, excessive Graph permissions, and client secrets or certificates added since October 13, 2026.
  • Log Limitations: Standard Entra audit logs alone cannot identify sources of Graph reads by apps, and MicrosoftGraphActivityLogs cannot be retrieved retroactively prior to enablement. For periods without collection, data access scope may remain undetermined.
  • Priority Mitigations: Prioritize least-privilege principles for service principals, immediate detection of app credential changes, and log preservation. Since App Instance Property Lock is a mechanism configured on the publisher side managing app registrations, verify implementation status with providers for third-party apps. Furthermore, user-focused Conditional Access does not protect this app-only flow. Conditional Access for workload identities does not cover third-party multitenant apps, so it should not be treated as a way to block these affected applications.

12. Facts / Inference / Hypothesis

Facts

  • ConnectWise confirmed unauthorized access to application IDs related to Cloud Backup, revoked certificates for affected connections across all users, and invalidated shared credentials.
  • Huntress confirmed unauthorized sign-ins across 162 tenants as of 2026-10-16 19:00 UTC. The 2026-10-17 update confirmed sign-in activity spanning approximately 1,000 tenants with over 300 successful records, but this aggregation is not a confirmed count of 300 compromised tenants.
  • Attackers authenticated as the Cloud Backup app using the OAuth 2.0 client credentials flow, obtaining Microsoft Graph app-only tokens without user login.
  • Due to existing consent granted to the Cloud Backup app, read/write and restoration capabilities for email, attachments, OneDrive, SharePoint, and Teams chats were available. In the tenants investigated by Todyl, no evidence supporting bulk data copying was found.
  • In one tenant examined in detail by Huntress, the Cloud Management - MS Teams app assigned Global Administrator to itself and added new client secrets to the MSP management app and Huntress app. The added Huntress credentials were used for seven sign-ins.
  • ConnectWise stated that there is no evidence of access to encrypted backup archives. Meanwhile, since the company cannot directly inspect downstream Microsoft 365 environments, customers must investigate app activity on their own.
  • In its update on 2026-10-18 01:00 UTC, ConnectWise explained that it disabled the seven affected application identities at 07:00 UTC the previous day, and that issued tokens or changes to other IDs require additional actions. Cloud Backup remains suspended with restoration timing undetermined. The statement that no successful threat activity was observed after mitigation applies only to ConnectWise's monitoring scope.

Inference

  • Because app-only authentication does not involve a user sign-in, user MFA and user-focused Conditional Access do not protect this flow. Service principal credentials and permissions therefore need to be monitored as high-value identities in their own right.
  • Since some Graph reads cannot be isolated to their sources using standard audit logs alone, organizations that have not pre-collected MicrosoftGraphActivityLogs may be unable to determine the full scope of data access.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in "Unknowns and Additional Investigation".

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1078.004 Valid Accounts: Cloud Accounts high Authenticated to Microsoft 365 tenants via app-only using compromised vendor-managed app credentials. Source
T1098.001 Account Manipulation: Additional Cloud Credentials high Added new client secrets to an existing MSP management application and the Huntress application in one tenant. Source

14. Unknowns and Additional Investigation

  • The specific vector by which app credentials leaked on the ConnectWise side, the threat actor's identity, and the total number of impacted tenants remain unconfirmed.
  • The actual scope of exfiltrated email, file, and Teams data has not been verified. Due to audit log limitations, the absence of records does not rule out access.
  • Whether role assignments by Cloud Management apps constituted legitimate vendor processing has not been confirmed for all tenants. It is also unconfirmed whether the credential addition in one tenant and the Cloud Backup mass authentication were performed by the same operator.

15. Impact on SOCs and Organizations

MSPs and SaaS backups represent a highly concentrated trust boundary where a single set of app credentials can reach numerous customer tenants. Organizations should verify across all tenants whether Cloud Backup (formerly SkyKick) is deployed, and prioritize investigating service principal sign-ins, app credential changes, directory role assignments, and Graph activity rather than user sign-ins.

16. Audience-Specific Summary

  • For SOCs: Search service principal sign-ins for suspicious IPs, Python user-agents, and target Application IDs, and correlate role assignments with added credentials chronologically.
  • For Administrators: Disable target apps according to ConnectWise instructions without deleting them, and review client secrets, certificates, and directory roles across all applications.
  • For Users: This is a cloud-side compromise occurring without user MFA interaction. User re-authentication or session revocation alone cannot stop app access, requiring administrative handling of apps and credentials.

Top comments (0)