ConnectWise Cloud Backup Credential Leak Exposes 173 Microsoft 365 Tenants

An active supply chain attack leveraging a compromised ConnectWise Cloud Backup credential has allowed unauthorized threat actors to access at least 173 Microsoft 365 customer environments. ConnectWise Cloud Backup—formerly SkyKick—is a multi-tenant cloud backup service used heavily by Managed Service Providers (MSPs) to back up Exchange Online mailboxes, OneDrive files, SharePoint sites, Teams communication, and Microsoft Entra ID directory objects. Because backup applications require extensive application permissions (such as Mail.ReadWrite, Files.ReadWrite.All, and Directory.Read.All) across every customer tenant where consent is granted, compromising the vendor’s application secret gives adversaries instant, high-privilege programmatic access across all consented tenants without needing to bypass user multi-factor authentication (MFA).

ConnectWise has temporarily shut down Cloud Backup application access while working to rotate compromised secrets and remediate the incident. However, because OAuth bearer tokens issued prior to app disabling remain valid for up to 90 minutes, impacted tenant administrators must immediately audit Entra ID sign-in and audit logs for unauthorized access and persistent backdoor credentials.

Automated Graph Token Harvest and Scripted Tenant Enumeration

Telemetry analyzed by security researchers reveals that the adversary possessed the client secret associated with the primary ConnectWise Cloud Backup application (506e08f9-6e9a-4da4-942b-a099a03644ae). Using custom tooling that mimicked the legitimate backup service, the threat actor authenticated directly against Microsoft Graph to request OAuth access tokens for target tenants.

On October 15, between 06:13 and 08:34 UTC, the attacker initiated a structured sweep from IP address 144.172.64[.]128. The activity iterated through tenant environments in sequential GUID order, requesting Graph tokens every few seconds. This behavior confirms the adversary operated from an automated target list of tenant IDs. Prior to the automated token harvesting sweep, the same IP address engaged in password spraying attacks targeting four law firm tenants on October 13 and 14, 2026, though no successful user logins were observed from those spray attempts.

The permissions inherited by these Graph tokens provided full visibility into tenant data. Attackers were capable of accessing Exchange Web Services (EWS) to read and extract mailboxes and attachments, reading files hosted in OneDrive and SharePoint, downloading Microsoft Teams chat logs, and querying directory structure details. Critically, directory read operations conducted via Microsoft Graph do not generate detailed audit entries in standard tenant telemetry, masking the full extent of data exfiltration.

Escalation into Enterprise Applications and Cross-Tenant Pivoting

The attack extended beyond passive data theft. In at least one observed partner tenant, the adversary leveraged a secondary application—the ConnectWise Cloud Management app for Microsoft Teams (application ID 24205314-2b89-4e07-a2a4-579e898a5640)—to escalate privileges and establish long-term persistence across trusted tools.

Once authenticated, the attacker assigned the Global Administrator role to the ConnectWise Cloud Management application. Using this elevated directory role, the attacker executed a Python script utilizing the Python-urllib/3.12 User-Agent to alter configuration settings for other high-privilege applications registered in the tenant. Specifically, the script added new client secrets to two multi-tenant software tools: an internal MSP management application and the Huntress Security Platform enterprise application.

This lateral movement technique turns trusted security and management software into vector points for secondary supply chain breaches. By embedding adversary-controlled client secrets into an MSP management app consented into downstream client tenants, the attacker creates a pathway to pivot directly into downstream customer environments with full administrative privileges, bypassing standard identity boundaries.

The Dynamics of Service Principal Exploitation

This incident underscores the unique risks associated with enterprise SaaS integrations and service principal governance in Microsoft Entra ID. Traditional account compromise mitigations—such as forcing password resets or terminating active user sessions (Revoke-AzureADUserAllRefreshToken)—have no effect on compromised OAuth application credentials.

When an application secret is leaked:

• No MFA Interference: Application-only authentication using client credentials flow bypasses interactive logon requirements, conditional access policies, and user MFA.
• Token Lifespan Persistence: Disabling the application object in Entra ID prevents Microsoft Identity Platform from issuing new access tokens. However, access tokens already issued prior to application disabling remain fully valid until their standard expiration window closes (up to 90 minutes).
• Silent Reconnaissance: Reading directory objects, user listings, and role assignments via application-level Microsoft Graph calls generates minimal standard log footprints compared to interactive user sessions.

Detection and Threat Hunting Guidance

Organizations utilizing ConnectWise Cloud Backup or managing M365 environments on behalf of clients should immediately execute the following hunting procedures in the Microsoft Entra Admin Center:

1. Audit Service Principal Sign-ins:

   • Navigate to Monitoring → Sign-in logs and select the Service principal sign-ins tab (note that standard user sign-in logs will not show this activity).
   • Filter logs by Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae.
   • Inspect the IP address column for connections originating from non-Microsoft public IPv4 ranges, specifically highlighting IP 144.172.64[.]128. Legitimate ConnectWise Cloud Backup egress typically routes through Azure private IPv6 infrastructure.

2. Check for Escalation and Unauthorized Application Credentials:

   • Review Entra audit logs spanning back to October 13, 2026, filtering for Add service principal credential or Update application – Certificates and secrets management events.
   • Inspect all modifications involving application ID 24205314-2b89-4e07-a2a4-579e898a5640 or any ConnectWise or SkyKick multi-tenant enterprise applications.
   • Audit directory role assignments to ensure no service principal was granted Global Administrator, Privileged Role Administrator, or Application Administrator roles without authorization.

3. Remediation Steps:

   • Disable the ConnectWise Cloud Backup enterprise application across all managed tenants until ConnectWise issues formal confirmation that all underlying secrets have been rotated.
   • Immediately delete any unrecognized client secrets or certificates added to security tools, MSP portals, or custom enterprise applications after October 13, 2026.
   • Enable Microsoft Graph activity logging in Microsoft Purview and Entra ID to capture programmatic data access during ongoing forensics.