ConnectWise Cloud Backup Breach Compromises M365 Tenants

An ongoing supply-chain incident involving ConnectWise Cloud Backup—formerly known as SkyKick Cloud Backup—has resulted in widespread Microsoft 365 tenant breaches across managed service providers (MSPs) and enterprise environments. By gaining unauthorized access to application identities within ConnectWise’s infrastructure, threat actors authenticated directly to customer Microsoft 365 tenants, bypassed traditional identity controls, and executed privilege escalation routines across compromised environments.

ConnectWise officially suspended access to its Cloud Backup infrastructure at 05:01 UTC on October 17, but incident reports and telemetry from Microsoft, Huntress, and Todyl confirm that malicious authentication attempts date back to at least October 13.

How the OAuth Supply-Chain Attack Works

This incident represents a classic OAuth service principal compromise, a class of supply-chain attacks that targets third-party trust relationships in cloud identity platforms rather than software vulnerabilities in local networks.

When organizations deploy cloud backup services like ConnectWise Cloud Backup to protect Microsoft 365 environments, they grant administrative consent to enterprise application service principals registered in Microsoft Entra ID. These enterprise applications rely on non-interactive authentication methods—specifically application client secrets or certificates—to perform automated tenant-wide backups of Exchange Online, Microsoft Teams, SharePoint, and OneDrive data.

Because service principal authentications occur at the application level without interactive user login, standard security controls fail to prevent access once credentials are leaked:

• Multi-Factor Authentication Bypass: MFA applies exclusively to user interactive logins and provides zero protection against application-only service principal authentication.
• Broad Pre-Granted Consent: To perform backup tasks, these application identities are granted sweeping tenant rights, such as Directory.ReadWrite.All or Exchange access roles.
• Token Persistence: Acquiring valid application secrets allows attackers to request OAuth tokens directly from Entra ID. Disabling an app stops new tokens from issuing, but existing tokens remain valid until expiration, and revoking user sessions does not terminate application-level access.

Threat Actor Operations and Persistence Mechanisms

Security researchers across Huntress, Todyl, and Microsoft Threat Intelligence mapped the malicious activity back to a single IP address: 144.172.64.128. Automated scripts used in the attack leveraged several HTTP User-Agent strings, including curl/7.88.1 during initial probing on October 13–14, and python-urllib/3.12, python-requests/2.31, and python-requests/2.34.2 during subsequent actions.

Once inside customer tenants, the threat actor’s behavior split into specific operational phases:

1. Reconnaissance and Data Enumeration: In several analyzed environments, the attacker executed automated sign-ins using the compromised secret to query Graph APIs and inspect mail, attachments, SharePoint files, and Teams conversations without altering tenant settings.
2. Directory Privilege Escalation: Across nearly 50 tenants monitored by Huntress, service principals associated with ConnectWise Cloud Management self-assigned high-privilege directory roles. Notably, the application ConnectWise Cloud Management - MS Teams (24205314-2b89-4e07-a2a4-579e898a5640) assigned itself Exchange Administrator and Global Administrator permissions.
3. Establishing Backdoors: In select tenants, the attacker established persistence within five minutes of initial access by generating and adding secondary client credentials to existing application registrations—including MSP management integrations and security platforms like Huntress.

One administrator reported receiving an automated Microsoft Privileged Identity Management (PIM) alert on October 15 when a legacy SkyKick service principal assigned itself Exchange Administrator permissions, despite the tenant not actively using the software for years.

Blast Radius for MSPs and Customer Tenants

The blast radius heavily impacts Managed Service Providers and their downstream Microsoft 365 customer tenants. Huntress alone confirmed at least 162 compromised tenants within its monitored dataset. Because ConnectWise Cloud Backup relies on broad administrative permissions across thousands of organizations, any threat actor holding vendor application secrets possesses immediate technical capability to read and manipulate sensitive tenant communications.

Crucially, ConnectWise’s emergency service shutdown only cuts off communication between ConnectWise’s cloud and Microsoft 365—it does not remove malicious credentials or backdoors already planted inside customer tenants. If an attacker added secondary credentials to an application registration before the shutdown, they retain unmonitored administrative access to that tenant.

Detection and Remediation Guidance

Administrators managing Microsoft 365 environments with active or historical ConnectWise/SkyKick integrations should execute immediate hunting and remediation measures:

1. Audit Entra ID Non-Interactive Sign-in Logs

Inspect Microsoft Entra ID Non-Interactive Sign-in logs from October 13 onward for requests originating from source IP 144.172.64.128 or using user agents curl/7.88.1, python-urllib/3.12, or python-requests/*. Filter specifically for the following application IDs:

• ConnectWise Cloud Backup: 506e08f9-6e9a-4da4-942b-a099a03644ae
• ConnectWise Cloud Management: 2399d300-6fca-4e6a-a686-399fefe75b83
• ConnectWise Cloud Management - MS Teams: 24205314-2b89-4e07-a2a4-579e898a5640
• ConnectWise Cloud Management - Exchange Online: b78f6a77-d4e5-46fb-87e5-d1648bd02519
• ConnectWise Cloud Management - MS Graph: 0de14c77-b9b0-4137-9360-34878a929827
• ConnectWise Cloud Management - Partner Center: 412dcf96-176d-4b3a-a1b0-4981ad66971e
• ConnectWise Cloud Management - SharePoint Online: b2b55f5b-7758-4719-8d8f-88ae172e6bdb

(Note: Older tenants may show these applications listed under SkyKick Cloud Manager.)

2. Inspect Application Credentials for Unauthorized Additions

Navigate to Entra ID > Enterprise Applications / App Registrations and review all secrets and certificates added since October 13 across all third-party integrations. Immediately delete any unrecognized client secrets or certificates to disrupt persistent backdoor access.

3. Revoke Application Permissions and Service Principals

Disable the implicated ConnectWise applications within Entra ID. If the integration is obsolete, remove the application registration, revoke all assigned directory roles (such as Exchange Administrator and Directory.ReadWrite.All), and clear lingering OAuth consent grants.