Stolen ConnectWise Credential Gives Attackers the Keys to 173 Microsoft 365 Tenants
A compromised credential belonging to ConnectWise Cloud Backup, formerly known as SkyKick, is being actively abused to walk straight into hundreds of Microsoft 365 environments without so much as a phishing email involved. Researchers at Huntress have confirmed unauthorised sign-ins across 173 partner and customer tenants, and the situation is still unfolding.
ConnectWise Cloud Backup is designed for managed service providers and, by necessity, holds sweeping permissions across every tenant it's deployed in. Mailboxes, OneDrive, SharePoint, Teams, directory data. The whole lot. That design makes it enormously useful for MSPs. It also makes a compromised credential for that app an absolute goldmine for an attacker.
According to Huntress researcher Jonathan Semon, the stolen credential was used to pull Microsoft Graph tokens from customer tenants on October 15, between 06:13 and 08:34 UTC, all originating from IP address 144.172.64[.]128. The attacker iterated through tenants in sorted GUID order, a few seconds apart. That's not manual browsing. That's a script running down a list.
The same IP had been caught doing password spraying against four law firm tenants on October 13 and 14, though no successful user logins were recorded at that point.
Things get worse. In at least one partner tenant, a separate ConnectWise app, the Cloud Management app for Microsoft Teams (AppID: 24205314-2b89-4e07-a2a4-579e898a5640), granted itself Global Administrator privileges and then used a Python script to add new credentials to two other trusted applications: an MSP management tool and, somewhat awkwardly, Huntress's own security platform. Once you have a credential on a tool that's already consented across multiple tenants, your access expands well beyond the initial breach point.
Todyl's head of Detection Engineering, Nicholas Koken, confirmed his team also observed the unauthorised Graph authentication and highlighted a critical point about token lifetimes. Revoking user sessions does nothing here. Disabling the app in a tenant stops new tokens being issued, but any tokens already handed out remain valid for up to 90 minutes. Every tenant where the app stays enabled stays exposed until ConnectWise actually rotates the underlying credential.
ConnectWise has now shut off Cloud Backup application access entirely while its investigation continues. The company says it has found no evidence that backup data itself was exfiltrated, though given that some Graph activity leaves no audit trail at all, that assurance has limited value without thorough log review.
Microsoft confirmed it is tracking the incident, describing it as an active supply chain attack involving abuse of a trusted OAuth application. On October 15, the company observed broad successful service principal authentications from the same IP. Follow-on activity included Graph API reconnaissance and attempts to add backdoor credentials to service principals in target tenants.
The full list of abused application IDs is as follows:
ConnectWise Cloud Backup: 506e08f9-6e9a-4da4-942b-a099a03644ae
ConnectWise Cloud Management: 2399d300-6fca-4e6a-a686-399fefe75b83
ConnectWise Cloud Management (MS Teams): 24205314-2b89-4e07-a2a4-579e898a5640
ConnectWise Cloud Management (Exchange Online): b78f6a77-d4e5-46fb-87e5-d1648bd02519
ConnectWise Cloud Management (MS Graph): 0de14c77-b9b0-4137-9360-34878a929827
ConnectWise Cloud Management (Partner Center): 412dcf96-176d-4b3a-a1b0-4981ad66971e
ConnectWise Cloud Management (SharePoint Online): b2b55f5b-7758-4719-8d8f-88ae172e6bdb
If you are an MSP with this application deployed, the immediate steps are: disable the app now, check Microsoft Entra service principal sign-in logs filtered by AppID 506e08f9-6e9a-4da4-942b-a099a03644ae, flag any authentication from non-Azure IP ranges, audit for new credentials added since October 13, and review Entra audit logs for ConnectWise or SkyKick apps assigning themselves directory roles. The standard user sign-in tab will not show you what you need. You want the Service Principal sign-ins tab.
Huntress noted a pattern worth knowing for triage purposes: the attacker appears to have worked through targets alphabetically, so organisations whose names start with 'A' may warrant priority attention, though every affected tenant should be treated as compromised until proven otherwise.
Separately, in a story with uncomfortable thematic similarities, Google Mandiant and ManageEngine have detailed an attack against the update infrastructure of AOMEI Backupper, a widely used backup and disk cloning tool. The attackers, tracked as UNC7017, conducted short bursts of tampering against AOMEI's update servers between April and July 2026, each window lasting only five to ten minutes before reverting to clean versions. During those windows, the update configuration was quietly redirected to pull a malicious ZIP from attacker-controlled servers.
The payload chain involved CROSSROAD, an initial downloader handling environment checks and persistence via scheduled tasks, followed by SHINYROAD, a modular backdoor using DLL sideloading for command-and-control. The campaign hit organisations across IT services, telecoms, higher education, and related sectors in over a dozen countries including the US, UK, Australia, India, and several European nations.
Two separate backup tool compromises in one news cycle. If your security posture still treats backup software as inherently trustworthy, now would be a good time to revisit that assumption.