Huntress and Todyl Say a Stolen ConnectWise Cloud Backup Credential Let an Attacker Sign In to Microsoft 365 Tenants as the Backup App, While a Sister App Made Itself Global Administrator

NEW YORK - A client credential belonging to ConnectWise Cloud Backup, the Microsoft 365 backup service formerly sold as SkyKick, was used from a rented server on Oct. 15, 2026 to collect Microsoft Graph access tokens in customer tenants, according to Huntress, Todyl and Microsoft Threat Intelligence, and in one tenant a sister ConnectWise application granted itself Global Administrator and planted new secrets on two other applications. Huntress said that as of 19:00 UTC on Oct. 16 it had confirmed unauthorized sign-ins in 162 tenants, and in a later update said it had found almost 1,000 Entra tenants with sign-in activity from the attacker's address, more than 300 of them successful. ConnectWise said it identified the issue on Oct. 14, published an advisory on Oct. 16, and at 07:00 UTC on Oct. 17 disabled seven of its application identities and suspended Cloud Backup by revoking the certificates behind them. Microsoft described the episode on Oct. 17 as an active supply chain attack against a trusted OAuth app.

The mechanics explain why customer-side controls did not help. Cloud Backup is a multi-tenant application: each customer's administrator consents to it once, and the publisher holds the secret or certificate that proves its identity in every tenant where it is installed. Huntress said Microsoft's sign-in logs record the credential type as a client assertion, meaning the credential lives in the vendor's tenant and nothing a customer did could have produced it. Todyl, which published its own running analysis on Oct. 16, said the actor used the OAuth 2.0 client credentials flow, received one app-only token per tenant, and logged Conditional Access as not applied, because no user, device or multifactor prompt is involved. Both companies said the sign-ins came from 144.172.64.128, an address Todyl traced to RouterHosting (AS14956), and moved through tenants in ascending tenant-GUID order a few seconds to a few minutes apart, a pattern both read as a script working from a target list. Huntress put the sweep between 06:13 and 08:34 UTC; Todyl saw it in its own tenants from 07:11 to 08:47 UTC. Legitimate backup traffic, both said, comes from Microsoft's private IPv6 space.

What the token could reach depends on what each tenant granted. Todyl said the app's consent allows read and write access to mail and attachments, including full mailbox access through Exchange Web Services, OneDrive and SharePoint files and Teams chats, plus the ability to restore data. Microsoft said the actor likely abused permissions customers had already granted, including Directory.ReadWrite.All, and that follow-on activity included Graph API reconnaissance and attempts to add credentials to the related service principal as a backdoor. Todyl found no directory changes by the backup app in any tenant it monitors and no mailbox or file reads in tenants without an active backup subscription. In tenants with an active subscription it could not separate the actor's reads from the backup service's, because both use the same identity and the per-request source addresses sit in Microsoft Graph activity logs that were not being collected.

Huntress's timeline is broader and, in one tenant, more serious. It said the same address password-sprayed four law-firm tenants on Oct. 13 and 14 with scripted token requests carrying a curl/7.88.1 user agent, with no successful user sign-ins. From 01:58 UTC on Oct. 15, in roughly 50 tenants it monitors, service principals for ConnectWise's Cloud Management apps assigned themselves directory roles, mostly Exchange Administrator, using the kiota-dotnet user agent ConnectWise's own apps use; Huntress said that points to vendor automation but that it had not confirmed it. Then, between 03:44 and 03:49 UTC, the Cloud Management app for Microsoft Teams added itself to Global Administrator in one customer tenant and a Python script, Python-urllib/3.12, made nine changes to two other applications, an MSP management application and Huntress's own Huntress Security Platform app. Six changes succeeded. Microsoft rejected a certificate over a thumbprint mismatch, and client secrets set to expire in 2028 were added instead. Huntress said those changes came from private Azure IPv6 space about two and a half hours before the first sign-ins from 144.172.64.128, and that it has not tied the two phases to the same operator. The planted credential on its app was used to sign in seven times in quick succession; Huntress removed it on Oct. 16 and said it cannot rule out reads, since Microsoft does not log everything an application reads.

inforcer, which manages Microsoft 365 tenants for MSPs, reported on Oct. 17 that about 3,800 of its managed tenants had the backup app installed and roughly two in three were not actively using it. Of 28 tenants it saw contacted from the rented server, only seven had the app installed and two were using it, which it said points to a target list kept somewhere other than the tenants themselves, including tenants where the app had been removed and several MSPs' own internal tenants. In two tenants, inforcer said, the Exchange app ended up holding a permanent Exchange Administrator assignment that had to be removed. Huntress later described a second, targeted wave from the same address on Oct. 15 against 16 of its tenants in the policy, national security, trade and critical mineral sectors, most of which do not use ConnectWise products; those attempts failed because the app was not present.

ConnectWise said the shared Cloud Backup credentials are no longer valid but that previously issued tokens may remain usable until they expire, and Todyl put that window at up to 90 minutes. The company said it has engaged a third-party forensics firm, has temporarily taken SaaS Security and Cloud Management offline, has no evidence that its encrypted backup archives were accessed, and has no restoration time. It said whether a product vulnerability contributed has not been established and that the credential-exposure mechanism is still under investigation. It also said Cloud Backup gives it no visibility into customer tenants, so it cannot say whether any of them saw unauthorized activity.

For SOC and MSP teams, the sources agree that disabling the vendor apps is necessary and not sufficient. Huntress and ConnectWise advise setting each listed application, starting with Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae) and Cloud Management for Microsoft Teams (24205314-2b89-4e07-a2a4-579e898a5640), to disabled for sign-in rather than deleting it, which preserves consent and evidence. Search the Service principal sign-ins tab, not the default user tab, for those application IDs and for 144.172.64.128 from Oct. 13, and ConnectWise suggests going back to Oct. 1 where retention allows; Entra keeps seven days of logs on the free tier and 30 on P1 and P2, so export now. In the audit log, look for Add member to role, Update application and Add service principal credentials where a ConnectWise or SkyKick app is the initiator, review the user agent, and inventory secrets and certificates on every app registration and enterprise application added since Oct. 13, starting with management and security tools. ConnectWise also lists Exchange checks for New-InboxRule, Set-Mailbox, Add-MailboxPermission and transport-rule changes, including hidden inbox rules. Microsoft said Defender raises Suspicious sign-in, Graph API activity from a Microsoft threat intelligence IP address and Verified Threat Actor IP alerts on the activity. Todyl recommends turning on Microsoft Graph activity logs, which are not retroactive, and both Todyl and ConnectWise note that Conditional Access for workload identities does not cover third-party multi-tenant apps, which leaves least-privilege consent and removing unused vendor apps as the controls that work today.