Cybersecurity researchers are sounding the alarm about an active campaign in which unknown threat actors are misusing a compromised Microsoft 365 (M365) ID belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers’ M365 environments.
ConnectWise Cloud Backup is a cloud-based backup and recovery service designed for managed service providers (MSPs) to secure their customers’ Microsoft 365 or Google Workspace data. To accomplish its tasks, the application has broad access to mailboxes, OneDrive, SharePoint, Teams, and directory data in each tenant on which it is installed.
Huntress said it observed confirmed unauthorized logins at 173 tenant partners/customers using compromised vendor credentials. The incident affects all orgs where the application is installed, and the credentials work against each tenant for which the application is authorized.
“The app’s credentials are in hostile hands,” said security researcher Jonathan Semon. “It was used to obtain Microsoft Graph tokens in client tenants starting at 144.172.64(.)128 on October 15, between 06:13 and 08:34 UTC. The actor moved among the tenants in sorted GUID order, every few seconds, which points to a script operating from a target list.”
In the observed attackers, the adversary authenticates to the application using its own tools, in a manner analogous to the backup service, and obtains tokens with the application’s existing permissions. Because the application has broad permissions to access customer data, an attacker in possession of the tokens can read mailboxes, files, and directory data that the backup service can read.
Huntress said the same IP address participated in password spraying against four law firm tenants on October 13 and 14, 2026, although she said she did not detect any successful user logins in her telemetry.
In at least one partner tenant, the cybersecurity company said it found a separate ConnectWise application granting itself global administrator privileges and adding credentials to other trusted applications within that environment, paving the way for other privileged applications in customer environments. This effectively extends the risk beyond the supplier’s account.
“The ConnectWise Cloud Management app for Microsoft Teams (app ID 24205314-2b89-4e07-a2a4-579e898a5640) added itself to the global administrator role and then ran a Python script (User-Agent Python-urllib/3.12) that modified two other apps in the tenant: an MSP management app and Huntress’s own app (Huntress Security Platform), adding a new secret client for both,” Semon explained.
“Both applications that received new secrets are trusted and privileged tools. Adding an identifier to an MSP management application can extend access beyond a single tenant, as these applications are often authorized in the tenants of the MSP’s customers. An identifier on a security tool’s application gives the holder everything that tool is authorized to do.”
Todyl, in a similar analysis, said it detected an unauthorized party authenticating to Microsoft Graph as the ConnectWise Cloud Backup application.
“Access inherited the app’s existing consent, which allows read/write access to mail and attachments (full mailbox access via Exchange Web Services), OneDrive and SharePoint files, and Teams chats, including the ability to restore data,” said Nicholas Koken, head of detection engineering at Todyl.
“Revoking user sessions does not terminate this access. Disabling the application in a tenant prevents new tokens from being issued, although tokens already issued will remain valid for up to 90 minutes. Any tenant where the application is still enabled remains exposed until ConnectWise rotates the credentials.”
In response to the incident, ConnectWise has made the decision to close access to the Cloud Backup application until further notice. The company said it found no evidence that backup data from Cloud Backup partners was compromised. He also shared the following steps to look for indicators of compromise:
- In the Microsoft Entra admin center, go to Monitoring → Connection Logs, select the Service Principal Connections tab, and filter by Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae.
- The default User Connections tab will not display the required information.
- In the IP Address column, review authentication activity coming from IP addresses outside of the expected Microsoft/Azure ranges. The normal application output was identified as Azure Private IPv6.
- Suspicious IP address: 144.172.64(.)128
“The backup service needs broad access to do its job, and an attacker using its credentials will inherit this level of access for each tenant the application is installed on,” Huntress explained.
“Depending on tenant permissions, this could include mailboxes, OneDrive and SharePoint files, Teams data, and directory information, much of which belongs to your customers. Some of these accesses, like directory reads via Microsoft Graph, leave no audit trail, which is why we suggest acting now instead of waiting for proof of access. The total potential impact depends on the permissions in play in each tenant.”
Users are recommended to disable the app until ConnectWise confirms that all credentials have been reset, enable Microsoft Graph activity logs, check any new credentials added since October 13, 2026, and check Entra audit logs for ConnectWise or SkyKick apps adding to a directory role.
This development comes as Mandiant and Google’s Google Threat Intelligence Group, along with ManageEngine Threat Analysis Lab, detailed “ephemeral supply chain tampering” of update infrastructure owned by AOMEI Backupper, a data backup, disk cloning and disaster recovery software, to bypass traditional security defenses and distribute malware such as CROSSROAD and SHINYROAD.
“The threat actor carried out repeated, short-term tampering with the configuration of AOMEI origin servers,” Google said. “Each tampering window remained active for only five to ten minutes before reverting to genuine versions. During the brief tampering windows, the threat actor modified the update settings file on the update server to redirect the software to download a malicious ZIP package from servers controlled by the attacker instead of legitimate updates.”
The ZIP archive contains CROSSROAD, an initial uploader responsible for validating the environment and preparing tracking payloads. It is also designed to establish scheduled, task-based persistence to deploy SHINYROAD, a modular backdoor framework for covert command and control, via DLL sideloading.
The software supply chain compromise campaign, which took place between April and July 2026, was attributed to a previously undocumented threat cluster named UNC7017. This is the first time such a compromise has occurred in short intervals instead of maintaining a persistent and static change on the servers.
The campaign reportedly reached organizations spanning a wide range of sectors, including IT services, telecommunications, higher education and associated entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Turkey and the United States.
An active supply chain attack
In an article on »
The tech giant said the threat actor likely abused permissions previously granted by customers to the app, including highly privileged permissions such as Directory.ReadWrite.All.
“On October 15, 2026, we observed a successful broad authentication of the service principal originating from the IP address 144.172.64(.)128,” it adds. “Follow-up activities included reconnaissance of the Microsoft Graph API and attempts to add additional credentials to the associated service principal in target tenants to maintain direct access as a backdoor. »
Microsoft recommends that security teams examine service principal logins from unrecognized IP addresses, changes to application credentials, and OAuth grant activity associated with the aforementioned OAuth AppId.
ConnectWise, in a separate advisory, confirmed that it has identified unauthorized access to application identities within the ConnectWise Cloud Backup environment. It has shut down access to Cloud Backup applications while its “investigative and remediation efforts continue.”
(This is a developing story. Please check back for details.)
Gn tech
