A compromised credential tied to a ConnectWise cloud backup application has allowed threat actors to access more than 170 Microsoft 365 environments managed by the company's partners and customers, with security researchers and Microsoft all tracking what they describe as an active supply chain attack.
The affected application, ConnectWise Cloud Backup, was formerly known as SkyKick before ConnectWise acquired it. The tool is designed for managed service providers (MSPs) and handles backup duties across Microsoft 365 and Google Workspace environments, covering mailboxes, OneDrive, SharePoint, Teams chats, and directory data for every tenant where it is installed. That built-in breadth of access is precisely what made the compromise so damaging.
Security firm Huntress confirmed unauthorized sign-ins across 173 partner and customer tenants. Researchers traced the suspicious activity to a single IP address, 144.172.64.128, which obtained tokens on October 15, 2026, between 6:13 and 8:34 UTC. The movement across tenants was methodical: the actor worked through environments in sorted GUID order, hitting each one a few seconds apart, a pattern consistent with an automated script running through a pre-built target list. Before that, the same IP address was used to password-spray four law firm tenants on October 13 and 14, though no successful user sign-ins were logged during that activity.
The attack went further than reconnaissance. In at least one partner tenant, a separate ConnectWise application called Cloud Management for Teams elevated itself to the Global Administrator role. From there, the actor added client secrets to an MSP management app and to Huntress's own app, using a Python-urllib/3.12 user agent. That kind of credential insertion is a classic backdoor move, designed to maintain persistent access even after the initial intrusion is addressed.
Huntress also noted that some of the access, particularly directory reads through Microsoft Graph, does not generate an audit trail, which complicates the task of establishing the full scope of what was seen or copied.
Security company Todyl, which also investigated the activity, pointed out that the inherited consent model made the damage difficult to contain quickly. Because the Cloud Backup application had been granted permission by tenant administrators, it could read and write to mail via Exchange Web Services, access OneDrive and SharePoint files, and reach Teams chats, including restoration capabilities. Revoking user sessions had no effect on the attack, since the access did not depend on user sign-ins. Disabling the application entirely stops new tokens from being issued, but tokens already in circulation remain valid for up to 90 minutes.
Microsoft confirmed it is tracking the campaign as an active supply chain attack, identifying it by the Cloud Backup application's OAuth App ID (506e08f9-6e9a-4da4-942b-a099a03644ae). The company said the actor likely abused Directory.ReadWrite.All permissions granted by customers, and observed follow-on activity including Graph API reconnaissance and attempts to add credentials to service principals as a persistence mechanism.
ConnectWise responded by shutting off Cloud Backup application access entirely and stated it found no evidence that partner backup data stored within the platform was copied or exfiltrated.
For organizations trying to determine whether they were affected, the key step is checking service principal sign-in logs in the Entra Admin Center, filtered by the Cloud Backup App ID. The default User sign-ins tab will not show this activity. Administrators should flag any sign-ins originating from IP addresses outside expected Microsoft or Azure ranges, since the application's normal outbound traffic uses Azure private IPv6. A full audit of any credentials added to applications since October 13 is also recommended, along with a review of Entra audit logs for any ConnectWise or SkyKick apps that added themselves to directory roles.
The ConnectWise incident surfaced alongside a separate supply chain campaign reported by Google Mandiant, Google Threat Intelligence Group, and ManageEngine Threat Analysis Lab. That operation, attributed to a previously undocumented threat cluster called UNC7017, repeatedly tampered with update servers belonging to backup software maker AOMEI. Between April and July 2026, attackers redirected downloads to malicious ZIP packages during short five-to-ten-minute windows. The payloads included a downloader called CROSSROAD and a modular backdoor named SHINYROAD, deployed through DLL sideloading. The campaign hit organizations in IT services, telecommunications, and higher education across roughly 11 countries, including the United States, Brazil, India, and Spain.
Together, the two incidents reinforce a pattern security researchers have flagged for years: backup tools and management platforms carry privileged access across dozens or hundreds of environments simultaneously, making them
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article: