TL;DR
- what: Unknown attackers stole the Microsoft 365 app credential used by ConnectWise Cloud Backup and used it to get Microsoft Graph tokens in customer tenants.
- impact: Huntress confirmed unauthorized sign-ins in 173 tenants, and the stolen credential carries the app's full consented access to mail, OneDrive, SharePoint, Teams and directory data in every tenant where the app is installed.
- fix: ConnectWise has shut off Cloud Backup application access until further notice and says it has found no evidence that partner backup data was compromised; exposure lasts until ConnectWise rotates the credential.
- who: MSPs that use ConnectWise Cloud Backup or SkyKick, and every client tenant where the app has been consented.
A single stolen credential belonging to ConnectWise Cloud Backup, the MSP backup service formerly sold as SkyKick, gave attackers a working key to customer Microsoft 365 environments. Huntress has confirmed unauthorized sign-ins in 173 partner and customer tenants. The credential is valid against every tenant where the app is consented, so the blast radius is every organization running the app, not just the 173 seen so far.
No user was phished and no MFA prompt was bypassed. The attacker signed in as the application itself, received tokens carrying the permissions the backup service already holds, and moved on to the next tenant.
What happened
ConnectWise Cloud Backup protects Microsoft 365 and Google Workspace data for MSP clients. To do that job, the app is granted broad access to mailboxes, OneDrive, SharePoint, Teams and directory data in every tenant where it is installed. That standing access is what the attacker inherited.
According to Huntress researcher Jonathan Semon, the stolen credential was used to request Microsoft Graph tokens in customer tenants from 144.172.64[.]128 on October 15, 2026, between 06:13 and 08:34 UTC. The actor worked through tenants in sorted GUID order, a few seconds apart. That pattern points to a script running down a prepared target list, not a person working by hand.
The attacker authenticated with their own tooling in the same way the backup service does. From Microsoft's point of view, those sign-ins look like the vendor app doing its normal work.
The same IP address ran password spraying against four law firm tenants on October 13 and 14. Huntress said it saw no successful user sign-ins from that activity in its telemetry.
Escalation: a second ConnectWise app takes Global Admin
In at least one partner tenant, Huntress found activity that pushes the risk past the backup credential. The ConnectWise Cloud Management app for Microsoft Teams (application ID 24205314-2b89-4e07-a2a4-579e898a5640) added itself to the Global Administrator role. It then ran a Python script (User-Agent Python-urllib/3.12) that changed two other applications in the tenant: an MSP management app and the Huntress Security Platform app. Both received new client secrets.
⚠️ Why the secondary secrets matter more than the backup data — MSP management apps are usually consented into many downstream customer tenants. A new secret on one of them can reach well beyond the tenant where it was added. A secret on a security tool's app gives the holder whatever that tool is allowed to do, including in environments that never had ConnectWise Cloud Backup installed.
What the attacker can reach
Todyl saw the same pattern on its side: an unauthorized party authenticating to Microsoft Graph as the ConnectWise Cloud Backup app. Nicholas Koken, Todyl's head of Detection Engineering, said the inherited consent covers:
- Read and write access to mail and attachments, including full mailbox access through Exchange Web Services
- OneDrive and SharePoint files
- Teams chats
- The ability to restore data, which is write access dressed as a backup feature
- Directory data, depending on the permissions granted in each tenant
Huntress notes that some of this access, such as directory reads through Microsoft Graph, leaves no audit trail. Tenants without Graph activity logging may never be able to prove whether data was read. That is why both firms are treating installation of the app as exposure, not waiting for proof of access.
Why standard containment does not close it
This is app-level access, so the usual identity playbook does not work here. Revoking user sessions does nothing, because no user session is involved. Per Todyl, disabling the app in a tenant stops new tokens from being issued there, but tokens already issued stay valid for up to 90 minutes. Any tenant where the app is still enabled stays exposed until ConnectWise rotates the credential, and only ConnectWise can do that.
Indicators published by ConnectWise and researchers — Cloud Backup application ID: 506e08f9-6e9a-4da4-942b-a099a03644ae. Suspicious source IP: 144.172.64[.]128. Normal app traffic comes from Azure private IPv6, so service principal sign-ins for this app from outside Microsoft and Azure ranges are anomalous. Related app: ConnectWise Cloud Management for Microsoft Teams, 24205314-2b89-4e07-a2a4-579e898a5640. Tooling marker: User-Agent Python-urllib/3.12. Relevant window: activity from October 13, 2026 onward.
Vendor response
ConnectWise has closed Cloud Backup application access until further notice and says it has found no evidence that Cloud Backup partner backup data was compromised. That statement covers the backup store. It does not cover what an attacker read live from customer tenants through Graph using the stolen credential, which is the exposure researchers are describing.
ConnectWise published hunting guidance based on service principal sign-in logs for the Cloud Backup application ID. The default user sign-ins view in Entra does not show this activity. Huntress and Todyl are advising that the app stay disabled until ConnectWise confirms every credential has been reset. They also call for full review of any credentials added to applications since October 13 and any ConnectWise or SkyKick app that added itself to a directory role.
Part of a wider pattern against backup tooling
This campaign comes as Mandiant, Google Threat Intelligence Group and ManageEngine's Threat Analysis Lab described separate tampering of AOMEI Backupper's update infrastructure. In that case, attackers changed origin server configuration in bursts of five to ten minutes before reverting, delivering CROSSROAD and SHINYROAD malware during each window. The two incidents use different methods but share a target choice: backup software is trusted, highly privileged and rarely watched closely.
RedEye assessment
This is a textbook third-party OAuth compromise, scaled across an MSP channel. The backup credential gave the attacker read and write access to data in at least 173 tenants within about two and a half hours. The Global Administrator escalation and the new secrets on an MSP management app and a security tool are the more serious finding, because they create persistence that survives ConnectWise rotating its own credential.
Organizations should assume that any tenant with the Cloud Backup or Cloud Management app consented was reachable during the window. Where Graph activity logging was off, the absence of evidence is not evidence of safety. The scope that matters is every app granted standing, tenant-wide permissions by a vendor, and every credential added to those apps since October 13.
Originally published on RedEye Threat Intelligence.
Top comments (1)
Useful detail that the default Entra user sign-in view doesn't show this. For anyone auditing their own tenant, the service principal sign-in logs are the place to look, and it's worth listing every third-party app with tenant-wide consent and asking if it still needs write access. A backup tool that can restore data effectively has write access to everything it backs up.