Unknown threat actors used a compromised ConnectWise Cloud Backup credential to gain unauthorized access to 173 Microsoft 365 partner and customer tenants, according to reporting by The Hacker News citing Huntress.
Huntress observed Microsoft Graph tokens being obtained on October 15, 2026, between 06:13 and 08:34 UTC from 144.172.64[.]128. The 173 figure represents tenants with confirmed unauthorized sign-ins—not individual users, customers or exposed records.
ConnectWise Cloud Backup, formerly SkyKick, is used by managed service providers to protect Microsoft 365 and Google Workspace data. In Microsoft 365 environments, its consented permissions can provide broad access to mailboxes, OneDrive, SharePoint, Teams and directory information.
Huntress said every organization where the application remains installed is within the credential’s potential reach. That is an exposure assessment; it does not mean every such tenant was accessed.
Attackers inherited the backup application's permissions
According to Huntress, the attackers authenticated to the Cloud Backup application using their own tooling and requested tokens carrying permissions already granted to the service. The observed tenants were accessed in sorted GUID order, only seconds apart, suggesting an automated process operating from a prepared target list.
Todyl separately reported detecting an unauthorized party authenticating to Microsoft Graph as the ConnectWise Cloud Backup application. It said the inherited consent could allow read-and-write operations involving:
- Email and attachments, including full mailbox access through Exchange Web Services
- OneDrive and SharePoint files
- Microsoft Teams chats
- Data restoration functions
Revoking ordinary user sessions does not terminate this application-level access, according to Todyl. Disabling the app prevents it from obtaining new tokens in that tenant, but tokens already issued can remain valid for up to 90 minutes. If the application stays enabled, exposure continues until ConnectWise rotates the compromised credential.
The same source IP also conducted password-spraying activity against four law firm tenants on October 13 and 14, 2026. Huntress said its telemetry showed no successful user sign-ins resulting from those attempts.
One tenant showed further privilege escalation
In at least one partner tenant, Huntress observed a separate application—the ConnectWise Cloud Management app for Microsoft Teams, with application ID 24205314-2b89-4e07-a2a4-579e898a5640—add itself to the Global Administrator role.
The application then ran a Python script identified by the user agent Python-urllib/3.12. That script added new client secrets to two other applications: an MSP management application and the Huntress Security Platform application.
This can expand the consequences beyond the original Cloud Backup credential. Huntress explained that MSP management applications are often consented across customer tenants, while a credential added to a security application inherits whatever operations that tool is authorized to perform.
The exact impact will therefore vary with the permissions granted inside each tenant.
ConnectWise closes application access
ConnectWise has closed Cloud Backup application access until further notice. The company said it had found no evidence that Cloud Backup partner backup data was compromised.
That statement is limited to backup data. It does not negate Huntress’s findings of unauthorized sign-ins to Microsoft 365 tenants through the application credential.
What administrators should check
ConnectWise identified the following Cloud Backup application ID and suspicious address:
- Cloud Backup application ID:
506e08f9-6e9a-4da4-942b-a099a03644ae - Suspicious IP:
144.172.64[.]128
Administrators can review the relevant records in:
Microsoft Entra Admin Center → Monitoring → Sign-in logs → Service principal sign-ins
The logs should be filtered for application ID 506e08f9-6e9a-4da4-942b-a099a03644ae. The default User sign-ins view does not display the service-principal activity required for this check.
ConnectWise said normal Cloud Backup egress uses Azure private IPv6 addresses. Authentication from addresses outside expected Microsoft or Azure ranges warrants review.
Huntress recommends that organizations:
- Disable the application until ConnectWise confirms that all credentials have been reset.
- Enable Microsoft Graph activity logs.
- Audit applications for new credentials added since October 13, 2026.
- Examine Entra audit logs for ConnectWise or SkyKick applications adding themselves to directory roles.
- Search for application ID
24205314-2b89-4e07-a2a4-579e898a5640and user agentPython-urllib/3.12.
Some activity, including certain Microsoft Graph directory reads, may not generate an audit trail, Huntress warned. Administrators should therefore not treat the absence of matching log entries as proof that a consented tenant was unreachable.
