Stolen ConnectWise Backup App Credential Opens Door to Over 170 Microsoft 365 Tenants

An unknown attacker obtained the credential behind ConnectWise Cloud Backup, a backup service formerly called SkyKick, and used it to sign in to customers' Microsoft 365 environments. Security firms Huntress and Todyl, along with Microsoft, have described the activity as an active supply-chain attack. Huntress has confirmed unauthorized sign-ins in 173 partner and customer tenants. A tenant is an organization's dedicated slice of Microsoft 365. The suspicious activity began on October 15. Administrators started reporting it publicly the following Friday, and ConnectWise has since cut off access to the Cloud Backup application until further notice.

What happened

ConnectWise Cloud Backup helps managed service providers (MSPs) back up and restore their clients' Microsoft 365 and Google Workspace data. MSPs are companies that run IT for other businesses. To back up a Microsoft 365 tenant, the service needs wide permissions across mailboxes, OneDrive, SharePoint, Teams and directory data. Those permissions are granted through Microsoft Entra ID, Microsoft's identity system.

The reported timeline runs as follows:

• October 13–14: Huntress says the IP address later tied to the attack, 144.172.64[.]128, ran password-spraying attempts against four law firm tenants. Password spraying means trying common passwords across many accounts. BleepingComputer reports that these scripted attempts used the user agent curl/7.88.1. Huntress saw no successful user sign-ins from this activity.
• October 15, 06:13–08:34 UTC: According to Huntress researcher Jonathan Semon, the same IP address used the backup app's credential to obtain Microsoft Graph tokens in customer tenants. Microsoft Graph is the main programming interface for Microsoft 365 data. The attacker worked through tenants in sorted order of their unique IDs, a few seconds apart. Huntress reads this as a script working from a prepared target list.
• Same period: One Reddit user said Microsoft's Privileged Identity Management service alerted them on October 15. The alert showed a SkyKick service principal giving itself the Exchange Administrator role, even though that organization had not used the app in years.
• The following Friday: Administrators began posting about a possible "SkyKick/CW breach." Huntress confirmed the concern the same day, initially reporting at least 162 compromised tenants. It later reported 173.
• Afterwards: Microsoft confirmed it had seen unauthorized authentication attempts from the IP address on October 15. ConnectWise published an advisory saying it had found unauthorized access to application identities in its Cloud Backup environment, and it shut down application access for partners and clients.

Who is affected

The exposure reaches every organization that has the ConnectWise Cloud Backup app installed in Microsoft 365, because the stolen credential works in every tenant where the app has been approved. Its legitimate application ID is 506e08f9-6e9a-4da4-942b-a099a03644ae.

Many affected tenants belong to MSPs or to the clients those MSPs manage, so much of the reachable data belongs to third parties. Some organizations that no longer actively used the app still appear to have been exposed, as the Reddit report shows. The only sector the sources name specifically is legal, through the four law firms targeted by password spraying. No geographic breakdown has been published.

Huntress also reports that other ConnectWise "Cloud Management" apps were involved in some tenants, covering Exchange Online, Microsoft Teams and Microsoft Graph.

How it works

In Microsoft 365, a third-party app is represented in each customer tenant by a service principal. A service principal is an identity for software rather than a person. When an organization approves, or "consents to," an app, the service principal receives a set of permissions. The app then proves who it is with a secret credential and receives access tokens.

According to Todyl, the attacker logged in directly as the backup application using its secret, with their own tooling. The resulting tokens carried every permission customers had already granted. No human user signed in, so protections such as multi-factor authentication (MFA) never came into play. Todyl says this access allowed reading and writing of mail and attachments, OneDrive and SharePoint files, and Teams chats, as well as restoring data. Microsoft believes the attacker probably abused existing permissions including Directory.ReadWrite.All, which allows broad changes to directory objects.

Beyond simply logging in, Huntress saw ConnectWise Cloud Management service principals give themselves directory roles, mostly Exchange Administrator, in nearly 50 tenants it monitors. In one partner tenant, the Cloud Management app for Microsoft Teams (ID 24205314-2b89-4e07-a2a4-579e898a5640) gave itself Global Administrator, the highest role. A Python script then added new client secrets to two other trusted apps in that tenant: an MSP management tool and Huntress's own security platform app. The whole sequence took about five minutes.

This step matters because MSP management tools are often approved across many customer tenants. A new secret on such a tool could extend the attacker's reach well beyond one organization. Microsoft also reported backdoor-style persistence after a successful service principal login, followed by reconnaissance through Microsoft Graph and attempts to add more credentials.

Researchers have linked several user agents to the malicious activity: python-urllib/3.12, python-requests/2.31 and python-requests/2.34.2. A user agent is the label software sends to identify itself.

How serious is it?

This is not a software vulnerability with a CVE or a CVSS score. It is the abuse of a stolen credential, and it is being actively exploited. Semon summed it up bluntly: "The app's credential is in hostile hands."

The sources agree on the attacker IP address, the start date and the basic technique. They differ on how far the attacker went:

• Todyl examined intrusions in nine tenants. It found only sign-in activity and no evidence of new accounts, added permissions, changed passwords or persistence through the backup app.
• Huntress saw role self-assignment in nearly 50 tenants and full persistence in at least one.
• Microsoft also reports persistence and attempts to add credentials.

These findings may not actually conflict. Todyl's statement covers the backup app specifically, while Huntress's escalation findings involve separate ConnectWise Cloud Management apps. The reported tenant count has also changed over time, from 162 to 173.

ConnectWise says it has seen no sign that partner backup data was compromised. It adds that the existing backup archive is unaffected and will be available once service returns. Huntress warns, however, that some access, such as directory reads through Microsoft Graph, leaves no audit trail. A lack of evidence in the logs therefore does not prove nothing was read.

What to do now

For Microsoft 365 administrators and MSPs:

• In the Microsoft Entra admin center, open Monitoring, then Sign-in logs. Select the Service principal sign-ins tab, which is not the default user tab, and filter by application ID 506e08f9-6e9a-4da4-942b-a099a03644ae.
• Look for sign-ins from IP addresses outside normal Microsoft and Azure ranges, especially 144.172.64[.]128. According to ConnectWise, the app normally connects from Azure private IPv6 addresses.
• Disable the ConnectWise Cloud Backup app in tenants where it is still enabled. Todyl notes that already-issued tokens can stay valid for up to 90 minutes after this, and that revoking user sessions does not end this kind of access.
• Review directory role assignments for ConnectWise Cloud Management service principals, looking especially for unexpected Exchange Administrator or Global Administrator roles.
• Check other privileged apps, particularly MSP management and security tools, for recently added client secrets. Remove any you did not create.
• Remove the app entirely from tenants that no longer use the service.
• Follow ConnectWise's advisory for credential rotation and service restoration.

For everyday users:

• If your organization's IT is run by an MSP, ask whether it uses ConnectWise or SkyKick Cloud Backup and whether your tenant was checked.
• Be alert to unusual emails or file-sharing activity that could follow mailbox access.
• Note that changing your own password does not block this particular access route.

What we still don't know

• How the Cloud Backup credential was stolen, and whether the Cloud Management apps were compromised in the same way.
• Who is behind the attack and what they want.
• The total number of affected tenants across all security vendors, not only those Huntress monitors.
• Whether any mailbox, file or Teams data was actually copied out.
• When ConnectWise will rotate the credential and restore the service.
• Whether the password spraying against law firms points to a particular target set.

ITVedas analysis: This incident shows that an app approved once and then forgotten can hold standing access that MFA does not protect. Organizations should audit third-party service principals as carefully as human admin accounts, and remove permissions for tools they no longer use.