Hackers Exploit Compromised ConnectWise Credential to Access 173 Microsoft 365 Tenants

Threat actors abused a compromised API secret belonging to ConnectWise Cloud Backup to gain unauthorized access to 173 Microsoft 365 partner and customer tenants. Huntress, a cybersecurity firm monitoring the incident, confirmed that the stolen credential allowed attackers to sign in as the trusted backup application across multiple environments.

The attackers used the ConnectWise Cloud Backup application ID 506e08f9-6e9a-4da4-942b-a099a03644ae to authenticate against Microsoft 365. On October 15, 2026, the malicious activity originated from IP address 144.172.64[.]128. Security researcher Jonathan Semon noted that the actor obtained Microsoft Graph access tokens between 06:13 and 08:34 UTC. The sign-ins occurred in sorted GUID order, with only seconds between attempts, indicating the use of an automated script against a prepared target list.

View the original post on X

Context and Background

Microsoft Threat Intelligence confirmed it is tracking this active supply chain attack involving ConnectWise Cloud Backup, formerly known as SkyKick Backup. The service is designed for managed service providers to secure client data in Microsoft 365 and Google Workspace. To perform its backup and recovery functions, the application requires broad access to Exchange mailboxes, OneDrive, SharePoint, Teams, and directory information in every tenant where it is installed.

Because the compromised credential was an app-only identity, the attackers did not need user passwords or multi-factor authentication. The login records showed a client assertion, meaning the secret came from the vendor’s home tenant rather than from actions inside each customer environment. This allowed the adversary to bypass standard user authentication controls entirely.

Who Is Affected

The incident impacts every organization that has the ConnectWise Cloud Backup app installed and consented in their tenant. Huntress observed confirmed unauthorized sign-ins within 173 partner and customer tenants. The compromised credential works against every tenant the app is authorized in, giving the attacker access to the same data the backup service can read.

In at least one Huntress partner tenant, the adversary escalated their access significantly. A second application, ConnectWise Cloud Management – MS Teams (application ID 24205314-2b89-4e07-a2a4-579e898a5640), assigned itself the Global Administrator role. The attacker then used a Python script to add new client secrets to two other trusted applications within that environment.

These newly added secrets were set to expire in 2028, potentially allowing the attacker to return through those other applications even if the original ConnectWise apps are disabled. This activity effectively extends the risk beyond the initial vendor account compromise. Huntress also noted that the same IP address engaged in password spraying against four law firm tenants on October 13 and 14, 2026, though no successful user sign-ins were detected.

ConnectWise has shut down customer access to its Cloud Backup service to halt the unauthorized access. This action has interrupted backup services for affected customers. No patch or fix has been confirmed yet for the compromised credential itself, as the issue stems from a stolen secret rather than a software vulnerability.

What should you do?

Security teams should immediately review all application registrations in their Microsoft 365 tenants for unauthorized changes or new secrets. Administrators should check for any apps that have been assigned Global Administrator or other high-privilege roles recently. Organizations should monitor sign-in logs for activity from the identified IP address 144.172.64[.]128 or the specific application IDs mentioned. Once the vendor provides an update or guidance, customers should follow instructions to rotate secrets and restore access.

Background: Threat intelligence program

A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.

Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats

What to do and how to stay safe: ConnectWise

• Audit all Microsoft 365 application registrations to identify any new client secrets or certificates added recently, especially those expiring in 2028.
• Review sign-in logs for the specific application IDs 506e08f9-6e9a-4da4-942b-a099a03644ae and 24205314-2b89-4e07-a2a4-579e898a5640 to detect unauthorized access.
• Check for any applications that have recently been assigned the Global Administrator role or other elevated permissions without explicit authorization.
• Monitor for any anomalous activity from IP address 144.172.64[.]128 or similar patterns of rapid, sorted GUID sign-ins in your tenant logs.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many Microsoft 365 tenants were affected by this breach?

Huntress confirmed unauthorized sign-ins in 173 partner and customer tenants using the compromised ConnectWise Cloud Backup credential.

Did the attackers need user passwords to gain access?

No, the attackers used a stolen app-only identity credential, which bypassed the need for user passwords or multi-factor authentication.

What immediate action has ConnectWise taken?

ConnectWise has shut down customer access to its Cloud Backup service to prevent further unauthorized access, which has interrupted backup services.