An attacker used a stolen credential for ConnectWise Cloud Backup to sign in to customers' Microsoft 365 tenants. ConnectWise Cloud Backup, formerly SkyKick Cloud Backup, is a backup service that managed service providers (MSPs) use to protect client data. Huntress first broke the news. As of 19:00 UTC on October 16, it had confirmed unauthorized sign-ins in 162 tenants that it monitors. Huntress and others stress that this is not a total count. ConnectWise says it "identified unauthorized access to application identities within the ConnectWise Cloud Backup environment." The company shut off application access for its partners and their clients, which has interrupted backup services until further notice. Microsoft has also confirmed the malicious activity, according to BleepingComputer. According to The Hacker News, as cited by SpecterOps, Microsoft calls it an active supply-chain attack. Nobody has publicly named the attacker, and ConnectWise has not said how the credential was obtained.
What Happened
The timeline below combines vendor, researcher and press accounts. All times are UTC.
- October 15, overnight: Inforcer reports that other apps from the same publisher went through tenants one after another a few hours before the main wave. In two tenants, one of those apps gave itself the Exchange Administrator role.
- October 15, 06:13 to 08:34: Huntress, as cited by TSN and SpecterOps, says the Cloud Backup app identity (App ID
506e08f9-6e9a-4da4-942b-a099a03644ae) signed in to customer tenants from144.172.64[.]128, a hosting provider address, and received Microsoft Graph access tokens. Legitimate traffic for this app normally comes from Azure private address space. Microsoft told BleepingComputer it saw unauthorized authentication attempts from an IP address on that date. - October 16, 17:47: ConnectWise publishes its first Trust Center advisory. That evening Huntress reports 162 compromised tenants.
- October 17, around 05:01: ConnectWise announces it is "shutting off Cloud Backup application access."
- October 17, 07:00: ConnectWise says it disabled seven of its application identities and revoked the certificates those connections used. It says the shared Cloud Backup credentials are no longer valid.
- October 18, 01:00: In its latest update, ConnectWise says it has brought in a third-party forensics firm and is reviewing other partner-facing services. It says it has "not observed successful threat activity" since its mitigations went in.
Huntress PRIMARY finding: In one partner tenant, a second app, ConnectWise Cloud Management - MS Teams (App ID 24205314-2b89-4e07-a2a4-579e898a5640), granted itself Global Administrator. It then added new credentials to two other applications in that tenant. One of them was a single-tenant Huntress application unique to that partner. Huntress has high confidence that the attacker also abused ConnectWise Cloud Management apps for Exchange Online, Teams, SharePoint Online, MS Graph and Partner Center.
Where accounts differ:
- Privilege escalation: Huntress describes a Global Administrator grant in one tenant. Inforcer describes an Exchange Administrator grant in two tenants. These may be separate observations from different customer bases, not a contradiction.
- Pacing: Inforcer says sign-ins came "a few minutes apart," one token per tenant in sorted tenant-ID order. SpecterOps, summarizing Huntress, says "a few seconds apart." Both accounts point to a script working from a target list.
What Was Taken
This part is unresolved, and the sources do not agree.
- ConnectWise: "We have no indicators to date that Cloud Backup partner backup data has been compromised." It says the existing backup archive is not affected.
- Inforcer: It has seen no evidence of data being read. However, it warns that "standard logs can't show what an app-only token was used for," and says any tenant with the app installed should treat its data as potentially exposed.
- Coalition: It notes separate MSP-community reports of email, SharePoint and Teams data being exfiltrated. ConnectWise has not confirmed these, and this brief does not treat them as established.
What could be reached is clearer than what was taken. Guardz, TSN and Coalition describe the app as having broad access to mailboxes, OneDrive, SharePoint, Teams and directory data. The Hacker News, cited by SpecterOps, reports that the permissions already granted included Directory.ReadWrite.All.
Scale of exposure: No overall victim count exists. Huntress's 162 is confirmed malicious sign-ins inside its own customer base only. Inforcer's figure is broader: about 3,800 of the tenants it manages had the backup app installed, and roughly two in three were not actively using it. ConnectWise has not disclosed how many customers are affected.
Why It Matters
- MFA and Conditional Access did not apply. The attacker signed in as the application itself. No user, device or MFA prompt was involved, so user-focused identity controls never came into play.
- Old consents are live attack surface. Inforcer says the target list included tenants that had not used the app in years, tenants that had already removed it, and some MSPs' own internal tenants.
- One credential reached many organizations. A single multi-tenant app credential gave access to tenants across many MSPs and, through them, to their clients. This is the same downstream amplification seen in earlier MSP-tooling incidents.
- A Huntress app was targeted. In at least one tenant, the attacker added credentials to a Huntress application. This suggests an attempt to persist through, or interfere with, the security tooling itself.
- The source IP is not a reliable signal. The second app's connections came from a Microsoft-internal private IPv6 range (
fde4:8dba:2600:37ce:6d26:200:a76:*). Huntress cautions that legitimate ConnectWise traffic and unrelated customer traffic also come from that range.
The Attack Technique
Huntress describes the root artifact as a compromised Microsoft 365 credential (an API secret) belonging to ConnectWise Cloud Backup. In Entra ID, the app is represented in each customer tenant by a service principal, which is the app's identity there. Anyone holding the app's secret or certificate inherits every permission that customers granted it.
Observed tradecraft:
- App-only sign-ins to obtain Microsoft Graph tokens, using one token per tenant.
- Indicators ConnectWise published: source IP
144.172.64.128, and user agentsPython-urllib/3.12andpython-requests/2.31. ConnectWise notes that these indicators alone do not confirm compromise. - Self-assignment of directory roles (Global Administrator or Exchange Administrator).
- Persistence by adding new credentials to other applications in the tenant.
How the attacker first obtained the credential has not been disclosed. ConnectWise notes that access tokens issued before it revoked the credentials "may remain usable until they expire."
What Organizations Should Do
- Disable the affected apps, but don't delete them. In every tenant, disable ConnectWise Cloud Backup (
506e08f9-6e9a-4da4-942b-a099a03644ae) and ConnectWise Cloud Management - MS Teams (24205314-2b89-4e07-a2a4-579e898a5640). Consider also disabling the other ConnectWise Cloud Management apps. Huntress advises disabling rather than deleting, and says disabling does not affect backups ConnectWise has already stored. - Review credentials on every application. Disabling the abused apps does not remove credentials the attacker already added. Check all app registrations and service principals for secrets or certificates added since October 13, as SpecterOps recommends.
- Audit directory role assignments. Look for Global Administrator, Exchange Administrator or other privileged roles assigned to service principals, and remove any you cannot explain.
- Hunt in sign-in and audit logs. Search service principal sign-ins for
144.172.64.128and the Python user agents above, focusing on October 15. Then cross-check against audit-log changes to apps and roles. - Clean up old consents. Inventory every third-party multi-tenant app across all managed tenants, check when each was last used, and remove the ones you don't need. Inforcer's data suggests most installs of this app were dormant.
- Assume exposure where the app was installed. App-only token activity is poorly logged, so treat mailbox, SharePoint and Teams data in affected tenants as potentially exposed. Confirm backup retention and restore options directly with ConnectWise.
Sources: Hackers breach Microsoft 365 tenants via ConnectWise supply-chain a... | ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks Hu... | Trust Center Advisories ConnectWise | When the backup app becomes the way in | ConnectWise Backup Credential Used to Breach M365 TSN | ConnectWise (SkyKick) Breach in Microsoft 365 Guardz.com | ConnectWise Investigating Unauthorized Access to Cloud Backup App | ConnectWise SkyKick Breach: M365 Tenant Check SpecterOps