ConnectWise has suspended its Cloud Backup service after attackers compromised application identities to gain unauthorized access to at least 162 Microsoft 365 tenants. The supply-chain attack utilized stolen application credentials to authenticate as a trusted service principal in customer environments, prompting the company to disable application access and suspend the Cloud Backup service while investigations continue.
Unauthorized Access to Microsoft 365 Tenants
The incident centers on the compromise of ConnectWise Cloud Backup, a service formerly known as SkyKick, which provides data protection for managed service providers (MSPs). By exploiting a stolen application credential, attackers authenticated as a trusted service principal, allowing them to inherit broad permissions—including access to emails, OneDrive, SharePoint files, and directory data—within customer environments. ConnectWise identified unauthorized access to application identities within its environment and subsequently shut down access for its partners and clients.
ConnectWise Attack Exposes Microsoft 365 Supply-Chain Security RisksA compromised third-party application credential has exposed a major security risk for organizations using Microsoft 365.Security firm Huntress reported unauthorized sign-ins across 173 Microsoft 365 tenants… pic.twitter.com/P7yiisF2Xf
— https://x.com/tchsignal/status/2111489120656875551
Security firm Huntress identified at least 162 compromised tenants, noting that the attacker’s activity was automated and targeted. According to Huntress researcher Jon Semon, the threat actor moved between tenants in a scripted fashion, with only seconds elapsing between each attempt. The attackers leveraged the compromised application credential to obtain Microsoft Graph tokens from hosting-provider IP address 144.172.64[.]128. This activity occurred on October 15, 2026, between 06:13 and 08:34 UTC. While ConnectWise detected the unauthorized access, the company officially disabled seven application identities on October 17, 2026, at 07:00 UTC to halt the ongoing threat.
Persistence and Potential for Escalation
While the initial breach relied on the compromised Cloud Backup credential (Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae), investigators discovered that the attackers attempted to establish deeper, long-term access. In at least one instance, a second application—ConnectWise Cloud Management for Microsoft Teams (Application ID 24205314-2b89-4e07-a2a4-579e898a5640)—was used to assign itself Global Administrator
privileges. Microsoft Threat Intelligence characterized the incident as an active supply-chain attack, assessing that the attacker likely abused existing permissions, including Directory. ReadWrite. All.
We have high confidence the threat actor also targeted the ConnectWise Cloud Management apps for Exchange Online, Microsoft Teams, and SharePoint, and we have confirmed abuse of the Teams app in one tenant.
Jon Semon, Principal Security Operations Analyst at Huntress
The attackers used the compromised credentials to perform reconnaissance via the Microsoft Graph API and attempted to add additional credentials to maintain persistence. Because these secrets were planted directly into the Microsoft 365 environments, disabling the ConnectWise applications alone does not remove the threat. Although disabling an application prevents the issuance of new tokens, those already issued remain valid for up to 90 minutes. Researchers noted that the attackers’ use of legitimate credentials and APIs made detection difficult, as the activity closely resembled normal administrative operations.
Ongoing Investigation and Service Status
As of October 18, 2026, ConnectWise continues to investigate the breach. Jason Ferguson of security operations, confirmed that teams are conducting forensic analysis and threat hunting. ConnectWise has stated that there are no indicators to date that partner backup data has been compromised, though the service interruption means that scheduled backups are not running and access to affected backup archives remains unavailable.
The exact mechanism used to obtain the initial vendor credentials remains unknown, though the attack pattern is consistent with historical incidents such as the SolarWinds supply chain attack and the 2021 Kaseya incident. ConnectWise has not yet attributed the attack to a specific threat actor. Administrators are urged to inspect Microsoft Entra service principal sign-in logs for suspicious activity associated with the 144.172.64[.]128 IP address and review all delegated admin relationships for necessity and scope. Microsoft also observed persistence activity via a backdoor after successful service principal authentication, and security teams suggest checking for user agents like python-urllib/3.12 and python-requests/2.31.
