ConnectWise — Supply-Chain Attack Breaches Microsoft 365 Tenants

Publication date: October 17, 2026
Category: Supply Chain Attacks

Introduction

Investigations carried out by cybersecurity platforms and Microsoft telemetry have exposed a supply-chain attack targeting ConnectWise’s cloud backup ecosystem (formerly SkyKick Cloud Backup). Attackers successfully accessed authorized service application identities within Microsoft Entra ID, facilitating unauthorized entry into more than 162 Microsoft 365 tenants. The intrusion was executed through automated authentication requests originating from the IP address 144.172.64[.]128, leveraging elevated privileges that organizations had previously granted to backup and management tools.

What is ConnectWise Cloud Backup Service? (General Analysis)

The ConnectWise Cloud Backup service operates as a backup and recovery solution designed for managed service providers (MSPs) and IT departments, providing protection for corporate data across cloud platforms such as Microsoft 365 and Google Workspace.

To interact with client corporate environments, these solutions rely on a trust model established through Microsoft Entra ID via an application identity known as a “service principal.” This entity grants the software specific permissions to read, manage, or write resources within the tenant. In this specific incident, no formal CVE identifier has been issued (reasoned risk vector estimation for logical identity failure: CVSS 8.6 High, conceptually classified under CWE-269: Improper Privilege Management), as the attack vector exploited inherent privilege abuse and legitimate application credential persistence rather than a traditional code vulnerability.

How Does It Work? (Technical Analysis)

Forensic analysis shared by incident response teams from Microsoft, Huntress, and Todyl describes a sophisticated operation based on application secret reuse and script automation.

  • Initial Entry and Authentication Flow: The attacker authenticated directly against Microsoft 365, emulating the legitimate backup application using its own app secret. Because these requests were executed via automated scripts (utilizing user agents such as python-urllib and curl), the sign-in mechanism did not require human user interaction, completely nullifying the effectiveness of multi-factor authentication (MFA) policies.
  • Permission Abuse and Reconnaissance: By leveraging the application identity—which already held broad permissions granted across each tenant—the threat actor gained the technical capability to read and write emails, OneDrive and SharePoint files, and Microsoft Teams chat logs.
  • Persistence and Privilege Escalation: Across multiple monitored tenants, the service principals associated with “ConnectWise Cloud Management” assigned themselves critical directory roles, predominantly the Exchange Administrator role and, in specific cases, the Global Administrator role. Additionally, researchers observed the surreptitious addition of new credentials to MSP management tools and the use of the Microsoft Graph API to perform reconnaissance and persistence tasks within extremely short operational windows (approximately five minutes).

Affected Systems / Environments

The incident directly impacts organizations and managed service providers utilizing ConnectWise’s cloud backup and management suites (formerly SkyKick). The compromised and implicated application IDs (App IDs) involved in the campaign include:

  • ConnectWise Cloud Backup: 506e08f9-6e9a-4da4-942b-a099a03644ae
  • ConnectWise Cloud Management: 2399d300-6fca-4e6a-a686-399fefe75b83
  • ConnectWise Cloud Management - MS Teams: 24205314-2b89-4e07-a2a4-579e898a5640
  • ConnectWise Cloud Management - Exchange Online: b78f6a77-d4e5-46fb-87e5-d1648bd02519
  • ConnectWise Cloud Management - MS Graph: 0de14c77-b9b0-4137-9360-34878a929827
  • ConnectWise Cloud Management - Partner Center: 412dcf96-176d-4b3a-a1b0-4981ad66971e
  • ConnectWise Cloud Management - SharePoint Online: b2b55f5b-7758-4719-8d8f-88ae172e6bdb

Mitigation and Detection

Remediation

System administrators and security teams must immediately execute containment actions to mitigate residual persistence risks:

  1. Disable Compromised Applications: Suspend and revoke access for the implicated ConnectWise Cloud Backup and Cloud Management applications across affected tenants.
  2. Credential and Secret Review: Thoroughly audit all applications in Microsoft Entra ID to detect unauthorized additions of credentials (secrets or certificates) dating from October 13 onward, removing any foreign entries.
  3. Token Revocation: Note that simply disabling the application halts the issuance of new tokens, but existing access tokens remain valid until their natural expiration; therefore, active sessions must be audited at the Graph API level.

Detection

To achieve early identification of anomalous activity associated with this supply-chain vector, apply the following search and inspection criteria within Microsoft Entra audit logs:

  • Filter application sign-in requests searching for the Cloud Backup App ID (506e08f9-6e9a-4da4-942b-a099a03644ae) and correlate with untrusted external IP addresses, specifically tracking the reported source IP 144.172.64[.]128.
  • Inspect requests originating from user agents associated with automated scripts, such as python-urllib/3.12, python-requests/2.31, python-requests/2.34.2, or curl/7.88.1.
  • Monitor modifications to directory roles assigned to service identities, paying close attention to self-assigned roles such as Exchange Administrator or Global Administrator.

“The abuse of legitimate application credentials with pre-consolidated permissions demonstrates how attackers bypass traditional user-based controls, turning trusted infrastructure tools into silent vectors for persistence and reconnaissance.”

Wrapping Up

The security incident within ConnectWise’s Cloud Backup service highlights the inherent vulnerability of excessive trust granted to third-party applications within corporate cloud environments. By compromising service identities endowed with broad privileges, threat actors managed to authenticate in an automated fashion without needing to breach human user credentials or trigger MFA alerts. The rapid response of platform providers and proactive containment underscore the urgency of maintaining strict auditing over OAuth consents, application secrets, and assigned directory roles across SaaS architectures.

References