connectwise2 articles
Stolen ConnectWise Credential Gives Attackers the Keys to 173 Microsoft 365 Tenants
Unknown threat actors have compromised a Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick), gaining unauthorized access to 173 customer and partner M365 tenants on October 15, 2026. Because the backup application holds broad permissions across mailboxes, OneDrive, SharePoint, and Teams, the attackers inherited extensive access to sensitive data in every affected tenant, with some activity also involving privilege escalation by adding Global Administrator rights and new credentials to other trusted applications. In response, ConnectWise has shut down Cloud Backup application access, while security firms and Microsoft are urging affected organizations to disable the app, audit service principal sign-in logs for the suspicious IP address (144.172.64.128), and review any credential changes made since October 13.
ConnectWise Pulls Cloud Backup Offline After Attackers Hijack Microsoft 365 Tenants
ConnectWise disabled seven application identities and suspended its Cloud Backup and Cloud Management services after unknown threat actors compromised the application credentials and used them to gain unauthorized access to Microsoft 365 customer tenants. The attack is particularly dangerous because the stolen application credentials allowed attackers to authenticate as ConnectWise's own applications and request access tokens from Microsoft Entra ID, potentially enabling access to mailboxes, SharePoint, Teams, and directory data — and even establish persistence by adding new credentials or applications within compromised tenants. Security firm Huntress has confirmed malicious activity across nearly 1,000 Entra tenants, with successful sign-ins in approximately 300, and identified a second targeted wave of attempts focused on 16 tenants in sensitive sectors including national security and critical minerals.