What happened?
Attackers have abused a stolen credential for ConnectWise Cloud Backup (formerly SkyKick Cloud Backup) to compromise at least 162 Microsoft 365 tenants in a supply‑chain attack.
By obtaining the application’s client secret, the adversary authenticated directly as the service principal that MSPs had installed in customer tenants. This let the attacker inherit all previously granted permissions – including Directory.ReadWrite.All and broad access to Exchange Online, OneDrive/SharePoint, and Teams data.
The incident has been confirmed by Microsoft, Huntress, and ConnectWise. In response, ConnectWise has:
- Suspended Cloud Backup, SaaS Security, and Cloud Management services;
- Disabled seven affected application identities on October 17, 07:00 UTC;
- Revoked certificates used by those apps.
Backup jobs, archive access, and restores are currently unavailable. According to ConnectWise, existing backup archives remain encrypted and isolated, and there is no evidence so far that those archives were accessed.
Technical details and TTPs
Technical evidence shows scripted sign‑ins from:
- IP: 144.172.64[.]128 (plus 144.172.64[.]60 and 144.172.64[.]99 as additional indicators);
- User agents:
python-urllib/3.12,python-requests/2.31,python-requests/2.34.2,curl/7.88.1.
The attacker used Microsoft Graph API calls rather than malware binaries, relying entirely on the stolen application credential.
In multiple tenants, the adversary:
- Escalated privileges by assigning Exchange Administrator and Global Administrator roles;
- Added new client secrets to other trusted apps to maintain persistence even if the original secret was rotated;
- Performed reconnaissance via Graph API, enumerating directory objects and attempting to add further credentials.
Because this is application authentication, it bypassed user MFA and device‑based controls – no user sign‑in was involved. The activity maps to several MITRE ATT&CK techniques, including T1078.004 (Valid Accounts: Cloud Accounts), T1195.002 (Supply Chain Compromise), T1098.003 (Additional Cloud Credentials), T1087.004 (Cloud Account Discovery), and T1550.001 (Application Access Token).
No specific threat actor has been publicly attributed as of October 18, 2026.
What MSPs and admins should do
ConnectWise urges all partners to follow its Cloud Backup technical investigation and remediation guide and to review both their own and all managed Microsoft 365 tenants.
Key checks for MSPs and Microsoft 365 administrators:
- Review Enterprise applications / App registrations for these application IDs:
- Cloud Backup:
506e08f9-6e9a-4da4-942b-a099a03644ae - Cloud Management core:
2399d300-6fca-4e6a-a686-399fefe75b83 - Cloud Management – MS Teams:
24205314-2b89-4e07-a2a4-579e898a5640 - Cloud Management – Exchange Online:
b78f6a77-d4e5-46fb-87e5-d1648bd02519 - Cloud Management – MS Graph:
0de14c77-b9b0-4137-9360-34878a929827 - Cloud Management – Partner Center:
412dcf96-176d-4b3a-a1b0-4981ad66971e - Cloud Management – SharePoint Online:
b2b55f5b-7758-4719-8d8f-88ae172e6bdb; - Search sign‑in and audit logs for activity from 144.172.64.0/24 and the above user agents;
- Inspect role assignments – especially Global Admin and Exchange Admin – for these apps and any related service principals;
- Rotate client secrets and certificates for affected applications and remove any unexpected credentials;
- Keep the ConnectWise apps disabled until official restoration guidance is published.
If you consume these services via a reseller, distributor, or marketplace, ensure the guidance reaches the administrator for each tenant. For ongoing status and updated IOCs, ConnectWise directs partners to its Trust Center and to report suspicious activity to [email protected].
Source: ConnectWise, Gündəm · rescana.com
