ConnectWise Cloud Backup Supply-Chain Attack: Analysis of Microsoft 365 Tenant Compromise and Mitigation Strategies

Executive Summary

On October 15, 2026, unauthorized access to application identities within the ConnectWise Cloud Backup (formerly SkyKick Cloud Backup) environment enabled attackers to compromise at least 162 Microsoft 365 tenants. The breach was executed via a supply-chain attack, leveraging a stolen application credential to authenticate as a trusted service principal in customer environments. This allowed the attacker to inherit all permissions previously granted to the application, including broad access to emails, files, and directory data. The attack was confirmed by multiple independent sources, including Microsoft, Huntress, and ConnectWise. The incident led to the suspension of ConnectWise Cloud Backup and related services, with ongoing investigations and remediation efforts. There is currently no evidence that backup archives were accessed or exfiltrated, but the full scope of tenant impact remains under review. The attack bypassed multi-factor authentication (MFA) due to its use of application credentials rather than user logins. All organizations using the affected ConnectWise applications are advised to review their environments for signs of compromise and follow the mitigation guidance provided below.

Technical Information

The attack exploited a compromised credential (client secret) for the ConnectWise Cloud Backup application, a trusted third-party service with broad permissions in customer Microsoft 365 tenants. The attacker used this credential to authenticate directly as the service principal, inheriting all permissions previously granted to the app, including Directory.ReadWrite.All. This access enabled the attacker to read and write emails, attachments, OneDrive and SharePoint files, and Teams chats.

Technical evidence from Microsoft, Huntress, and ConnectWise confirms that the attacker initiated sign-in activity from the IP address 144.172.64[.]128, using automated scripts with user agents such as python-urllib/3.12, python-requests/2.31, python-requests/2.34.2, and curl/7.88.1 (BleepingComputer, 2026-10-17, ConnectWise Advisory, 2026-10-18, SpecterOps, 2026-10-17). The attack did not involve malware binaries but relied on the abuse of stolen application credentials and automated access to the Microsoft Graph API.

Privilege escalation was observed in several tenants, where the attacker used the service principal’s permissions to assign itself elevated roles such as Exchange Administrator and Global Administrator, and to add credentials to other trusted applications. In at least one case, persistence was established by adding new client secrets to other applications, ensuring continued access even if the original credential was reset.

The attack bypassed user-based security controls, including MFA, because application authentication does not trigger user or device-based prompts. The attacker also performed reconnaissance using the Microsoft Graph API, enumerating directory information and attempting to add additional credentials.

The attack is mapped to several MITRE ATT&CK techniques, including T1078.004 (Valid Accounts: Cloud Accounts), T1195.002 (Supply Chain Compromise: Compromise Software Dependencies), T1098.003 (Account Manipulation: Additional Cloud Credentials), T1087.004 (Account Discovery: Cloud Account), and T1550.001 (Use Alternate Authentication Material: Application Access Token).

No specific threat actor group has been attributed to this incident as of October 18, 2026. The tactics, techniques, and procedures (TTPs) are consistent with both financially motivated and state-sponsored actors, but no unique malware or infrastructure links have been published.

Affected Versions & Timeline

The affected products are ConnectWise Cloud Backup (formerly SkyKick Cloud Backup) and related ConnectWise Cloud Management applications, including integrations for Exchange Online, Microsoft Teams, Microsoft Graph, Partner Center, and SharePoint Online. The following application IDs were abused:

ConnectWise Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae), ConnectWise Cloud Management (2399d300-6fca-4e6a-a686-399fefe75b83), Cloud Management - MS Teams (24205314-2b89-4e07-a2a4-579e898a5640), Cloud Management - Exchange Online (b78f6a77-d4e5-46fb-87e5-d1648bd02519), Cloud Management - MS Graph (0de14c77-b9b0-4137-9360-34878a929827), Cloud Management - Partner Center (412dcf96-176d-4b3a-a1b0-4981ad66971e), and Cloud Management - SharePoint Online (b2b55f5b-7758-4719-8d8f-88ae172e6bdb).

The timeline of the incident is as follows:

On October 13-14, 2026, scripted sign-in attempts from 144.172.64[.]128 were observed. On October 15, 2026, the attacker used the compromised credential to access customer tenants. ConnectWise identified the issue on October 14, 2026, and began incident response. On October 17, 2026, ConnectWise disabled the affected application identities and suspended the Cloud Backup service. As of October 18, 2026, investigations and remediation efforts are ongoing, and service restoration timing has not been announced.

Threat Activity

The attacker leveraged a compromised application credential to authenticate as the ConnectWise Cloud Backup service principal in customer Microsoft 365 tenants. This allowed the attacker to inherit all permissions previously granted to the application, including broad access to emails, files, and directory data. Automated scripts were used to move through tenants rapidly, with sign-in activity observed from the IP address 144.172.64[.]128.

In several cases, the attacker escalated privileges by assigning elevated roles such as Exchange Administrator and Global Administrator to the service principal or related applications. Persistence was established in at least one tenant by adding new client secrets to other trusted applications, enabling continued access even after the original credential was reset.

Reconnaissance was performed using the Microsoft Graph API, including directory enumeration and attempts to add additional credentials. The attack bypassed MFA and other user-based security controls due to its use of application authentication.

The primary victims were managed service providers (MSPs) and their downstream customers, particularly those using ConnectWise Cloud Backup for Microsoft 365. At least 162 tenants were confirmed compromised by Huntress, but any tenant with the affected application installed is at risk. The sectors impacted include IT service providers, small and medium businesses, and organizations relying on MSPs for Microsoft 365 management and backup.

Mitigation & Workarounds

The following mitigation steps are prioritized by severity:

Critical: Immediately disable the affected ConnectWise applications in your Microsoft Entra (formerly Azure AD) admin center, specifically application ID 506e08f9-6e9a-4da4-942b-a099a03644ae and related application IDs listed above. Keep these applications disabled until ConnectWise confirms that all credentials have been reset and provides restoration instructions.

Critical: Review all application credentials, secrets, and certificates for unauthorized additions since October 13, 2026. Remove any unauthorized entries and revoke unnecessary application consents, especially for dormant or unused SkyKick or ConnectWise Cloud Backup integrations.

High: Examine sign-in and audit logs for service principal authentication tied to the affected application IDs, focusing on activity from the source IP 144.172.64[.]128 and suspicious user agents (python-urllib/3.12, python-requests/2.31, python-requests/2.34.2, curl/7.88.1).

High: Review directory roles, owners, consent grants, and recent policy changes for signs of privilege escalation or unauthorized access.

Medium: Check for unauthorized mailbox forwarding, inbox or transport rules, and delegated mailbox access in affected tenants.

Medium: Preserve all relevant logs and audit records for further investigation and potential incident response.

Low: Monitor for updates from ConnectWise regarding service restoration and additional remediation guidance.

Note that disabling an application stops new tokens from being issued, but existing tokens may remain valid until they expire. Revoking user sessions does not end application-based access. The vendor’s shutdown does not remove credentials already planted in customer tenants; manual review and removal are required.

Indicators of Compromise

The following indicators are point-in-time and should be validated before enforcement. Their presence alone does not confirm compromise.

References

All claims in this report are directly supported by the following sources:

https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/ (October 17, 2026)

https://www.connectwise.com/company/trust/advisories (last updated October 18, 2026)

https://specterops.io/blog/2026/10/17/connectwise-skykick-breach-microsoft-365/ (October 17, 2026)

About Rescana

Rescana provides a third-party risk management (TPRM) platform that enables organizations to continuously monitor, assess, and respond to risks in their vendor ecosystem. Our platform supports the identification of supply-chain exposures, facilitates rapid incident response, and helps organizations validate the security posture of their critical service providers.

We are happy to answer questions at info@rescana.com.