Stolen ConnectWise Credential Opens Door to 173 Microsoft 365 Tenants

Researchers at Huntress and Todyl are warning of an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick). The cloud backup service, built for managed service providers (MSPs), is granted broad access to mailboxes, OneDrive, SharePoint, Teams, and directory data in every tenant where it is installed.

One key, many environments

Huntress has confirmed unauthorized sign-ins across 173 partner and customer tenants. According to researcher Jonathan Semon, the stolen credential was used to obtain Microsoft Graph tokens from 144.172.64[.]128 on October 15, between 06:13 and 08:34 UTC. The actor moved through tenants in sorted GUID order, a few seconds apart — the signature of a script working from a prepared target list.

With those tokens the attacker inherits the app's full rights: reading mail, files, and directory data. The same IP also ran password spraying against four law firm tenants on October 13 and 14, though no successful sign-ins were observed there.

Spreading inside the environment

In at least one partner tenant, a separate ConnectWise Cloud Management app for Teams assigned itself the Global Administrator role, after which a Python script added new client secrets to two other trusted applications — an MSP management tool and Huntress's own security platform. Because such apps are often consented into an MSP's customer tenants, this pushes the risk well beyond a single account.

Todyl flags an alarming detail: revoking user sessions does not end this access. Disabling the app stops new tokens from being issued, but those already issued stay valid for up to 90 minutes. And some activity, such as directory reads through Microsoft Graph, leaves no audit trail at all — which is why experts urge acting now rather than waiting for proof of compromise.

Response and guidance

ConnectWise has temporarily closed Cloud Backup application access and says it found no evidence that partner backup data was compromised. Users are advised to disable the app until all credentials are reset, enable Microsoft Graph activity logs, audit for new credentials added since October 13, and review Entra logs for ConnectWise or SkyKick apps granting themselves directory roles. Suspicious activity can be traced under Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae in the service principal sign-ins tab.

The incident coincided with a separate report: Google Mandiant and ManageEngine described an "ephemeral supply chain tampering" of AOMEI Backupper's update infrastructure. From April to July 2026, a cluster tracked as UNC7017 redirected downloads to malicious servers in short five-to-ten-minute bursts, delivering the CROSSROAD downloader and the modular SHINYROAD backdoor.

Source: The Hacker News