Hackers abused a compromised vendor credential belonging to ConnectWise Cloud Backup to infiltrate 173 Microsoft 365 customer tenants on October 15, 2026. The unauthorized access exploited broad permissions to harvest Microsoft Graph tokens, prompting urgent remediation and security advisories from Microsoft, Huntress, and ConnectWise.
Compromised ConnectWise Cloud Backup Credential Breaches 173 Microsoft 365 Tenants
A stolen vendor secret has exposed managed service providers and their downstream clients to unauthorized digital entry. Security researchers sounded the alarm regarding an active campaign involving a compromised Microsoft 365 credential tied to ConnectWise Cloud Backup, formerly known as SkyKick Backup. The affected software is designed to protect cloud environments for managed service providers, granting it extensive read and write permissions across mailboxes, OneDrive, SharePoint, Teams, and directory databases.
ConnectWise Attack Exposes Microsoft 365 Supply-Chain Security RisksA compromised third-party application credential has exposed a major security risk for organizations using Microsoft 365.Security firm Huntress reported unauthorized sign-ins across 173 Microsoft 365 tenants… pic.twitter.com/P7yiisF2Xf
— https://x.com/tchsignal/status/2111489120656875551
Investigators confirmed that the malicious activity affected 173 partner and customer tenants. Threat actors leveraged a client assertion, indicating that the secret originated directly from the vendor’s home tenant rather than through a password compromise inside any single customer environment. The unauthorized authentication utilized the official ConnectWise Cloud Backup application ID, designated as `506e08f9-6e9a-4da4-942b-a099a03644ae`. According to Microsoft Threat Intelligence, the app authenticated and pulled Microsoft Graph access tokens during the campaign.
The attack began on October 13, 2026, with unauthorized access attempts detected at 03:12 UTC. No malware was identified during the incident, and no specific threat actor attribution has been made, though analysts noted that the tactics align with both financially motivated and state-sponsored actors who have historically targeted managed service providers to gain broad downstream entry.
Tenant Escalation and Python Scripting Tactics Discovered by Huntress
The breach went beyond simple data reconnaissance. In at least one partner tenant, investigators discovered a separate ConnectWise application elevating its own permissions to the Global Administrator role.
The ConnectWise Cloud Management app for Microsoft Teams (application ID 24205314-2b89-4e07-a2a4-579e898a5640) added itself to the Global Administrator role, then ran a Python script (User-Agent Python-urllib/3.12) that modified two other applications in the tenant: an MSP management application, and Huntress’s own application (Huntress Security Platform), adding new client secrets to both.
Jonathan Semon, via The Hacker News
The newly generated secrets were configured to remain valid until 2028, creating a long-term persistence mechanism that standard user session revocations cannot clear.
Technical Analysis of Microsoft Graph Permissions and Persistence
The intrusion exploited the inherent design of multitenant cloud backups. Because backup utilities require deep access to function, an unauthorized party possessing the vendor’s application tokens inherits sweeping privileges. Nicholas Koken, Todyl’s head of Detection Engineering, warned that the access inherited the application’s existing consent profile, which permits full mailbox access through Exchange Web Services, direct file reading across OneDrive and SharePoint, and chat history retrieval in Teams.
Defenders face significant hurdles in mitigation because traditional incident response steps fall short against active token abuse. Disabling an app integration halts the issuance of new tokens in that specific tenant, but tokens already generated remain valid for up to 90 minutes. Furthermore, simply deleting applications can disrupt legitimate recovery operations and fail to purge hidden client secrets injected into other app registrations.
Microsoft sign-in logs also revealed a second application connecting from the private IPv6 range `fde4:8dba:2600:37ce:6d26:200:a76:*`. Because disabling original ConnectWise apps does not automatically remove credentials already planted in separate app registrations, defenders must review all application secrets and certificates rather than relying solely on ConnectWise entries.
ConnectWise Response and Mandatory Remediation Steps for IT Administrators
In response to the multi-tenant compromise, ConnectWise suspended Cloud Backup application access until further notice. The vendor stated it found no evidence that partner backup archives themselves were compromised during the incident. Meanwhile, security advisories from software platforms and Microsoft urge immediate, targeted auditing across enterprise environments.
Impacted organizations are instructed to disable, but not delete, the ConnectWise Cloud Backup and ConnectWise Cloud Management – MS Teams service principals. Deleting them removes consent outright and makes service recovery harder, whereas disabling the applications pauses automated backups while preserving archives already stored by the vendor. Users are further recommended to enable Microsoft Graph activity logs, audit for any new credentials added since October 13, 2026, and check Entra audit logs for ConnectWise or SkyKick applications adding themselves to a directory role.
Administrators are advised to consult the Microsoft Entra Admin Center by navigating to Monitoring and selecting Service principal sign-ins, filtering specifically for the compromised Cloud Backup application ID.