A compromised vendor credential belonging to ConnectWise’s Cloud Backup service (formerly SkyKick Cloud Backup) has been used to sign into more than 160 confirmed Microsoft 365 tenants without triggering password prompts or multi-factor authentication, in what Microsoft has characterised as an active supply-chain attack. ConnectWise has suspended customer access to Cloud Backup, Cloud Management, and SaaS Security, and disabled the affected application identities while the incident remains under investigation.
What Happened
ConnectWise’s backup products operate through a Microsoft Entra ID “service principal” — an application identity granted standing permissions inside each customer’s tenant so it can read and back up mailboxes, SharePoint, OneDrive, and Teams data without a human logging in. Because authentication happens app-to-app rather than user-to-app, MFA and conditional access policies that gate human sign-ins do not apply.
Huntress telemetry shows scripted sign-in attempts beginning October 13–14 from the IP address 144.172.64[.]128, initially password-spraying four law firm tenants before shifting, from October 15, to directly requesting Microsoft Graph tokens using the compromised ConnectWise Cloud Backup application secret (app ID 506e08f9-6e9a-4da4-942b-a099a03644ae). Huntress says nearly 1,000 Entra tenants saw sign-in attempts from the attacker’s infrastructure, with more than 300 succeeding, and it has directly confirmed unauthorized access in 162 tenants it protects. A second, more targeted wave on October 15 hit 16 tenants in policy, national security, trade, and critical-minerals-adjacent sectors — several of which did not even run ConnectWise products, suggesting broader reconnaissance alongside the credential abuse.
In at least one tenant, a ConnectWise Cloud Management application assigned itself the Global Administrator role and added credentials to an MSP management tool and to Huntress’s own application — a privilege-escalation step that would allow the attacker to read and tamper with virtually anything in that environment and to re-establish access even after the original credential is revoked. Other observed activity includes service principals granting themselves Exchange Administrator rights across roughly 50 monitored tenants.
ConnectWise says it has no evidence that backup archive contents were accessed, and that archives remain encrypted and isolated. However, the company has cautioned that previously issued access tokens may continue to work until they naturally expire, meaning disabling the applications does not instantly close the access window.
Why It Matters
This is not a conventional phishing or credential-stuffing incident — it is abuse of a trusted software supply chain. RMM and backup vendors that serve managed service providers sit with elevated, often over-provisioned permissions across hundreds of downstream customer tenants simultaneously. A single compromised vendor credential becomes a master key, bypassing the identity controls — MFA, conditional access, risk-based sign-in — that organisations rely on for human accounts. The pattern echoes other 2026 RMM-targeting incidents and underscores that MSP-adjacent application identities are now a preferred initial-access vector for attackers seeking breadth over depth.
Finance, healthcare, and communications organisations are disproportionately represented among MSP clients that outsource IT and backup management specifically because they lack in-house security staff — the same organisations least equipped to independently audit service-principal activity in their own tenants.
Recommended Actions
- Identify whether your organisation or MSP uses ConnectWise Cloud Backup, Cloud Management, or legacy SkyKick applications, and disable (not delete) those app registrations pending ConnectWise’s confirmation that credentials have been fully rotated.
- Review Entra ID sign-in logs for service-principal activity from 144.172.64[.]128, 144.172.64[.]99, and 144.172.64[.]60, and for user agents including python-requests, python-urllib, and curl/7.88.1.
- Audit directory role assignments and application credential/secret additions made since October 13, specifically looking for service principals that granted themselves Exchange Administrator, Global Administrator, or similar roles.
- Do not assume disabling an application ends attacker access — revoke and rotate any client secrets or certificates added without a corresponding change request, and treat existing tokens as potentially live until expiry.
- Monitor ConnectWise’s advisory page for confirmation that credentials have been reset before re-enabling any suspended application.