Attackers have used a compromised ConnectWise Cloud Backup credential to access 173 Microsoft 365 partner and customer tenants, turning a trusted backup integration into a broad, cross-tenant access path. Huntress said the credential, tied to ConnectWise Cloud Backup—formerly SkyKick Backup—was used to obtain Microsoft Graph tokens without requiring an end-user login or a multifactor authentication prompt. Huntress reported the activity as an active incident involving an unknown threat actor. [14]
The affected application has broad permissions because it backs up and restores Microsoft 365 data. Depending on the consent granted in a tenant, those permissions can reach mailboxes, OneDrive, SharePoint, Teams, directory data, users, groups and applications. Huntress observed the application identity authenticating from 144.172.64[.]128, a hosting-provider address, and moving through tenants in sorted GUID order seconds apart—behavior consistent with an automated target list. The confirmed total had reached 162 tenants as of 19:00 UTC on Oct. 16 before subsequent reporting placed the figure at 173. [14][2]
The incident is especially serious because the abused secret was a vendor-side client assertion, rather than a password controlled by an individual customer. As a result, the access could work in every tenant where the ConnectWise application had been granted consent. App-only access also bypasses user-focused protections such as MFA challenges, while directory reads through Microsoft Graph may not produce the same audit evidence as ordinary mailbox or file activity. Huntress cautioned that a lack of visible mail or file access does not establish that data was not taken. [14]
Researchers also identified potentially dangerous activity involving the separate ConnectWise Cloud Management – MS Teams application, ID 24205314-2b89-4e07-a2a4-579e898a5640. In one tenant, it assigned itself the Global Administrator role and added new client secrets to other applications, creating a possible persistence and privilege-escalation path. Huntress mapped the behavior to MITRE ATT&CK techniques for valid cloud accounts, additional cloud roles and additional cloud credentials, but has not publicly attributed the campaign to a named threat actor. [14]
Huntress recommends that administrators immediately disable—not delete—the ConnectWise Cloud Backup service principal, ID 506e08f9-6e9a-4da4-942b-a099a03644ae, in Microsoft Entra, and temporarily disable related ConnectWise or SkyKick applications that cannot be verified as safe. Teams, email, files and user sign-ins should continue operating, but automated backups will pause and may create a recovery-point gap. Defenders should review service-principal sign-ins, role assignments, application updates and credentials added since Oct. 13, with particular attention to unexpected Global Administrator grants and activity from the reported IP address. Organizations should not restore the integrations until ConnectWise confirms that affected credentials have been reset. Huntress’ response guidance provides the Entra search and containment steps. [14]
References
- Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
- ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks | Huntress
