ConnectWise Cloud Backup Hack Exposes Microsoft 365 Tenants in Supply Chain Attack
ConnectWise has cut off customer access to its cloud backup service, formerly known as SkyKick Cloud Backup, after attackers gained access to application IDs and compromised Microsoft 365 tenants.
Reports of malicious activity began appearing Friday, when administrators observed unauthorized access to Microsoft 365 customer data linked to a potential “SkyKick/CW compromise.” Huntress later confirmed that it had identified at least 162 compromised tenants within its environment.
Microsoft also confirmed malicious activity involving ConnectWise’s Cloud Backup service and said it observed fraudulent authentication attempts from attacker-controlled IP addresses on October 15.
ConnectWise’s cloud backup platform provides backup and recovery services for managed service providers (MSPs) and IT teams. The service helps protect and restore customer data, including emails and files, in cloud environments such as Microsoft 365 and Google Workspace.
For Microsoft 365 Backup, the service relies on permissions granted through Microsoft Entra ID. A software application is represented in a customer’s tenant by a service principal, which can access resources according to the permissions previously granted to it.
ConnectWise Cloud Backup application IDs exploited
In a security advisory, ConnectWise said it had “recently identified unauthorized access to application IDs within the ConnectWise Cloud Backup environment.” The company has disabled access to the application for partners and customers while it investigates the incident.
“So far, there is no indication that backup data from our cloud backup partners has been compromised. Existing cloud backup archives are not affected by this service interruption and will be accessible once service is restored,” ConnectWise said.
The company has launched an investigation and said it is taking remedial action.
Reports from Microsoft, Huntress, and affected administrators indicate that the malicious activity began at least as early as October 15 from the IP address 144.172.64.[.]128.
One Reddit user reported receiving a Microsoft Privileged Identity Management (PIM) alert on October 15. The alert warned that the SkyKick service principal had assigned itself the Exchange Administrator role, even though the application had not been used for years.
Some of the application IDs identified in the attack match those reported by Huntress, Microsoft, and Todyl, a cybersecurity platform aimed primarily at MSPs and IT professionals.
According to Todyl researchers, the attacker used Microsoft 365 secrets to authenticate directly to Microsoft 365 as a backup application. This allowed the attacker to use permissions that customers had already granted to the application.
Traditional protections such as multifactor authentication (MFA) were ineffective because the sign-ins were performed by automated scripts rather than through an interactive user login.
“These sign-ins gave the attackers the technical ability to read and write emails and attachments, OneDrive and SharePoint files, and Teams chats, as the application already held extensive permissions previously granted to each tenant,” Todyl said.
In its analysis of nine tenants, Todyl identified sign-in activity but found no evidence that the attackers created accounts, added permissions, changed passwords, or established persistence through the backup applications.
Attackers escalated privileges in some Microsoft 365 tenants
However, Huntress said it was monitoring approximately 50 tenants in which ConnectWise Cloud Management service principals for Exchange Online, Microsoft Teams, and Microsoft Graph had assigned directory roles to themselves, primarily the Exchange Administrator role.
Huntress researchers observed persistence in one tenant, where the operation took approximately five minutes.
During the activity, the Cloud Management – MS Teams application, identified by the ID 24205314-2b89-4e07-a2a4-579e898a5640, granted itself the Global Administrator role and added credentials to MSP management tools and Huntress applications.
Microsoft observed similar persistent activity. After successful service principal authentication, the attackers performed reconnaissance against the Microsoft Graph API and attempted to add additional credentials through the backdoor.
Microsoft, Huntress, and Todyl all linked the malicious activity to the same IP address, 144.172.64.[.]128.
Microsoft Threat Intelligence characterized the incident as an active supply chain attack and said the attackers may have exploited existing permissions, including Directory.ReadWrite.All.
Indicators of compromise and Microsoft 365 tenant checks
Huntress identified the legitimate ConnectWise Cloud Backup application ID used in the attack:
506e08f9-6e9a-4da4-942b-a099a03644ae
The investigation also found scripted sign-in attempts from the attacker’s IP address on October 13 and 14. Those attempts used the user agent curl/7.88.1.
Based on current evidence, at least three user agents are associated with malicious cloud backup service activity:
python-urllib/3.12python-requests/2.31python-requests/2.34.2
ConnectWise recommends that administrators review service principal sign-ins in Microsoft Entra ID, filter for the Cloud Backup application ID, and look for unexpected source addresses.
Microsoft also recommends reviewing application credential changes, OAuth grants, and related Microsoft Graph activity.
Huntress advises administrators to disable the relevant ConnectWise applications, check application credentials for unauthorized additions, and review other cloud management integrations. Older tenants may list the applications under the name “SkyKick Cloud Manager.”
The following application IDs should be searched:
- ConnectWise Cloud Backup:
506e08f9-6e9a-4da4-942b-a099a03644ae - ConnectWise Cloud Management:
2399d300-6fca-4e6a-a686-399fefe75b83 - ConnectWise Cloud Management – MS Teams:
24205314-2b89-4e07-a2a4-579e898a5640 - ConnectWise Cloud Management – Exchange Online:
b78f6a77-d4e5-46fb-87e5-d1648bd02519 - ConnectWise Cloud Management – MS Graph:
0de14c77-b9b0-4137-9360-34878a929827 - ConnectWise Cloud Management – Partner Center:
412dcf96-176d-4b3a-a1b0-4981ad66971e - ConnectWise Cloud Management – SharePoint Online:
b2b55f5b-7758-4719-8d8f-88ae172e6bdb
Disabling the application may not revoke existing access
Credentials already embedded in a customer’s tenant are not removed when the vendor disables the service. Huntress recommends reviewing all application secrets and certificates for unauthorized additions made after October 13 and removing suspicious entries.
Todyl cautions that disabling an application prevents new tokens from being issued, but existing tokens remain valid until they expire. Revoking a user session also does not terminate application-based access.
ConnectWise announced the interruption of its backup services at 05:01 UTC on October 17 but did not provide a timeline for restoring connectivity.
The company said it has found no evidence that stored backups were compromised and that existing archives will be accessible once service is restored.
At the time of publication, the total number of victims, the scope of any data theft, and how the attackers obtained the vendor credentials remain unknown.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop dramatically.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com