Cybersecurity researchers have reported an active campaign in which unknown threat actors are allegedly abusing a compromised Microsoft 365 credential associated with ConnectWise Cloud Backup, formerly known as SkyKick Backup, to gain access to customer environments. Security firm Huntress said it observed unauthorised sign-ins across 173 partner and customer Microsoft 365 tenants using the compromised vendor credential. The incident affects organisations where the ConnectWise Cloud Backup application has been installed because the application receives broad permissions required to protect Microsoft 365 data, including access to mailboxes, OneDrive, SharePoint, Teams, and directory information.
ConnectWise Cloud Backup is a cloud based backup and recovery service designed for managed service providers (MSPs) to protect customer data across Microsoft 365 and Google Workspace environments. Due to the nature of backup operations, the application requires extensive permissions within connected tenants. Huntress researcher Jonathan Semon said the compromised application credential was used to obtain Microsoft Graph tokens in customer environments from the IP address 144.172.64[.]128 on October 15, 2026, between 06:13 and 08:34 UTC. According to the analysis, the activity moved through tenants in a sequence based on tenant identifiers, with only a few seconds between each access attempt, suggesting automated activity using a prepared target list. Researchers said attackers were able to authenticate to the application using their own tools and inherit the permissions already granted to the backup service.
The access provided by the compromised credential could allow attackers to view mailboxes, files, directory information, and other resources available to the application. Huntress also observed related activity involving password spraying attempts against four law firm tenants on October 13 and 14, although the company reported no successful user sign-ins from those attempts. In at least one customer environment, Huntress identified another ConnectWise related application assigning itself Global Administrator privileges and adding credentials to trusted applications. Researchers said this activity could potentially expand access beyond a single tenant because many privileged applications used by MSPs are connected across multiple customer environments. The ConnectWise Cloud Management application for Microsoft Teams was observed adding itself to the Global Administrator role and modifying other trusted applications by adding new client secrets.
Todyl reported similar findings, stating that an unauthorised party authenticated to Microsoft Graph using the ConnectWise Cloud Backup application and inherited the permissions already approved by customers. These permissions included access to email content, attachments, OneDrive and SharePoint files, Teams chats, and restoration capabilities. Security researchers warned that disabling user sessions alone would not fully remove the risk because existing access tokens may remain valid for a limited period. Todyl said disabling the application can prevent new tokens from being issued, but affected environments remain exposed until the compromised credential is rotated.
Following the discovery, ConnectWise confirmed that it identified unauthorised access involving application identities within the ConnectWise Cloud Backup environment and temporarily disabled Cloud Backup application access while investigation and remediation efforts continue. The company said it has not found evidence that Cloud Backup partner backup data was compromised. Microsoft also confirmed it was tracking the incident as an active supply chain attack involving a trusted OAuth application. Microsoft said attackers likely abused previously granted permissions, including highly privileged permissions such as Directory.ReadWrite.All, to obtain access tokens and perform Microsoft Graph activity across customer tenants. Security teams have been advised to review Microsoft Entra service principal sign-in logs, monitor unusual application activity, investigate unexpected credential additions, and review OAuth grant changes linked to the ConnectWise Cloud Backup application ID. Researchers recommend temporarily disabling the application until credential rotation and remediation activities are completed. The incident highlights the security risks associated with highly privileged third party applications and the importance of monitoring identity-based access across cloud environments.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
