Full Report
ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. [...]
Analysis Summary
# Incident Report: ConnectWise Cloud Backup Supply-Chain Compromise of Microsoft 365 Tenants
## Executive Summary
Attackers used application identities in ConnectWise's Cloud Backup service (formerly SkyKick Cloud Backup) to authenticate to customers' Microsoft 365 tenants, gaining the broad permissions those customers had previously granted the backup app. Huntress identified at least 162 compromised tenants in its environment, and in some tenants the attacker escalated privileges, including adding a Global Administrator role and new credentials. ConnectWise shut down customer access to the service while it investigates and remediates, and states that it has no indicators that partner backup data was compromised.
## Incident Details
- **Discovery Date:** Reports emerged on a Friday, shortly before the article's October 17, 2026 publication. Administrators first noticed unauthorized access to client data. Huntress confirmed the activity later that day.
- **Incident Date:** Malicious activity began at least October 15, 2026, per Microsoft, Huntress, and administrator reports.
- **Affected Organization:** ConnectWise (vendor of Cloud Backup, formerly SkyKick). Downstream victims are managed service providers (MSPs) and their Microsoft 365 customer tenants. Huntress reports at least 162 compromised tenants in its environment. Todyl analyzed nine intruded tenants.
- **Sector:** Managed service providers, cloud backup/SaaS, and IT services (supply chain).
- **Geography:** Not disclosed in the article.
## Timeline of Events
### Initial Access
- **Date/Time:** At least October 15, 2026. Exact start time not disclosed.
- **Vector:** Unauthorized authentication using the backup application's service principal and its client secret. The attacker authenticated directly to Microsoft 365 as the backup app, with no user involved.
- **Details:**
- Activity originated from a single IP address, 144.172.64[.]128, which Microsoft, Huntress, and Todyl all tracked.
- Sign-ins were performed by an automated script. Because no user login occurred, MFA did not apply.
- The attacker used permissions customers had already granted to the app, which were broad (including Directory.ReadWrite.All according to Microsoft).
- A Reddit user reported a Microsoft Privileged Identity Management (PIM) alert on October 15 showing a SkyKick service principal assigning itself the Exchange Administrator role, even though the customer had not used the app in years. This is a single anecdotal report.
### Lateral Movement
- **Privilege escalation within tenants:** On nearly 50 tenants monitored by Huntress, service principals for ConnectWise's Cloud Management apps (Exchange Online, Microsoft Teams, and Microsoft Graph) assigned themselves directory roles, mostly Exchange Administrator.
- **Persistence and expansion (one tenant, per Huntress):** The attacker took roughly five minutes to have Cloud Management – MS Teams (application ID 24205314-2b89-4e07-a2a4-579e898a5640) grant itself the Global Administrator role. It also added credentials to an MSP management tool and to Huntress's own application.
- **Microsoft Graph API reconnaissance:** Microsoft observed a backdoor activating after successful service principal authentication, followed by Graph API reconnaissance and attempts to add more credentials.
### Data Exfiltration/Impact
- **Access capability:** Per Todyl, the permissions allowed reading and writing mail and attachments, OneDrive and SharePoint files, and Teams chats.
- **Observed activity:** In the nine tenants Todyl analyzed, researchers saw only sign-in activity. They found no evidence that the attacker created accounts, added permissions, changed passwords, or established persistence through the backup app.
- **Unauthorized access to client data:** Administrators reported unauthorized access to client data in their Microsoft 365 tenants. The article does not quantify data accessed or exfiltrated.
- **Partner backup data:** ConnectWise states it has "no indicators to date" that Cloud Backup partner backup data was compromised. The existing archive is reportedly unaffected by the service interruption.
### Detection & Response
- **Detection:** Administrators noticed unauthorized client data access and raised a potential "SkyKick/CW breach." Huntress confirmed the activity and reported 162 compromised tenants. Microsoft identified unauthorized authentication attempts from the IP address on October 15 and later published a statement. Todyl and Huntress published analyses.
- **Response actions:**
- ConnectWise shut down application access for partners and clients.
- ConnectWise opened an investigation and started remediation.
- Microsoft Threat Intelligence characterized the event as an active supply-chain attack and assessed that the attacker likely abused existing permissions.
- Huntress and Todyl published indicators and tenant-check guidance.
## Attack Methodology
- **Initial Access:** Authentication as the ConnectWise/SkyKick Cloud Backup service principal using its client secret, from 144.172.64[.]128, via automated scripts (valid-credential abuse of a third-party application identity).
- **Persistence:** Added credentials to service principals (including an MSP management tool and Huntress's application). A backdoor was observed after service principal authentication. In at least one tenant, a Cloud Management application granted itself Global Administrator. Todyl did not find persistence in the nine tenants it analyzed.
- **Privilege Escalation:** Self-assignment of directory roles by service principals, mostly Exchange Administrator, and in one tenant Global Administrator. This used the existing Directory.ReadWrite.All-level permissions.
- **Defense Evasion:** The attack used legitimate application identities and sign-ins, so no user-based MFA challenge was triggered. The article does not describe other specific evasion techniques.
- **Credential Access:** Abuse of compromised or exposed application secrets. How the secret was obtained is not disclosed.
- **Discovery:** Microsoft Graph API reconnaissance after authentication.
- **Lateral Movement:** Movement across tenants via the trusted vendor application identity, and from the application into directory roles and other service principals.
- **Collection:** Read access to mail, attachments, OneDrive, SharePoint, and Teams chats was available. Collection activity was not confirmed in the nine Todyl-analyzed tenants.
- **Exfiltration:** Not described in the article.
- **Impact:** Unauthorized access to client tenants, privilege escalation, and backup service disruption (customer access shut down).
## Impact Assessment
- **Financial:** Not disclosed.
- **Data Breach:** Potential access to email and attachments, OneDrive and SharePoint files, and Teams chats across affected tenants. The actual volume and what was accessed are not confirmed in the article.
- **Operational:** Cloud Backup service shut down for customers and partners, interrupting backup and restore services for MSPs and their clients. Affected tenants required investigation and remediation.
- **Reputational:** Significant impact on ConnectWise/SkyKick trust, given the supply-chain nature of the attack and its effect on MSPs and their customers.
## Indicators of Compromise
- **Network indicators:**
- Source IP: 144.172.64[.]128
- **Application/identity indicators:**
- Cloud Management – MS Teams application ID: 24205314-2b89-4e07-a2a4-579e898a5640
- Abused service principals: ConnectWise Cloud Management apps for Exchange Online, Microsoft Teams, and Microsoft Graph; the SkyKick/Cloud Backup service principal
- Unexpected credentials added to MSP management tool and Huntress application service principals
- **File indicators:** None listed in the article.
- **Behavioral indicators:**
- Unexpected Exchange Administrator or Global Administrator role assignments to service principals
- Automated, non-interactive sign-ins by the backup app from unfamiliar IP addresses
- PIM activation alerts for dormant service principals
- Graph API reconnaissance and new credential additions to applications
Refer to the Huntress, Todyl, and Microsoft publications and ConnectWise advisory for full IOC lists and tenant-check queries.
## Response Actions
- **Containment:**
- ConnectWise shut down application access for partners and clients.
- Customers should revoke or disable the Cloud Backup service principal and rotate its secrets (verify against vendor guidance).
- **Eradication:**
- Review and remove unauthorized role assignments, especially Exchange Administrator and Global Administrator, on service principals.
- Remove unexpected credentials (secrets and certificates) on service principals.
- Investigate and remove any backdoor or added application credentials discovered in the tenant.
- **Recovery:**
- ConnectWise is investigating and remediating. Service will be restored once remediation is complete. The existing cloud backup archive is expected to be accessible.
- Affected tenants should review audit logs for mail, OneDrive, SharePoint, and Teams access, and validate their tenant state.
## Lessons Learned
- **Key takeaways:**
- Third-party application identities with broad, standing permissions (such as Directory.ReadWrite.All) create high-value supply-chain risk. A compromise of the vendor's secret can extend to every customer tenant.
- Non-interactive service principal sign-ins bypass user MFA. Protections need to focus on workload identities.
- Dormant applications with privileged roles are dangerous. A service principal unused for years was still able to assign itself Exchange Administrator.
- Vendor-side compromise may not be visible to customers until alerts or unusual role changes appear.
- **What could have been done better:**
- Apply least privilege to third-party app permissions and avoid standing directory-level write access.
- Use stronger authentication for service principals, such as certificate-based credentials or workload identity federation, rather than long-lived client secrets.
- Enable and monitor alerts for role assignments to service principals and for PIM activations.
- Use conditional access and sign-in risk policies for workload identities, and restrict sign-ins by IP or location where possible.
- Regularly review and remove unused enterprise applications and their consents.
## Recommendations
- **Inventory and reduce third-party app access:** Audit all enterprise applications and consented permissions in Entra ID. Remove unused apps and revoke excessive permissions such as Directory.ReadWrite.All.
- **Harden service principals:** Replace client secrets with certificates or federated credentials where supported. Set short secret lifetimes, and rotate secrets on a schedule and after vendor incidents.
- **Monitor privileged role changes:** Alert on Exchange Administrator, Global Administrator, and other high-privilege role assignments, especially to service principals. Review PIM audit logs regularly.
- **Monitor workload identity sign-ins:** Alert on service principal sign-ins from unexpected IPs or at unusual times. Use Microsoft Entra Workload Identity protection where available.
- **Vendor risk management:** Require MSP and SaaS vendors to disclose how they store and rotate credentials for customer tenant access. Ask for documentation of least-privilege scopes and incident notification commitments.
- **Immediate actions for affected or potentially affected tenants:**
- Check for the IOCs above, including IP 144.172.64[.]128 and application ID 24205314-2b89-4e07-a2a4-579e898a5640.
- Review role assignments and added credentials on all service principals.
- Review mail, OneDrive, SharePoint, and Teams audit logs from October 15, 2026 onward.
- Rotate credentials for any third-party app with broad permissions, following vendor guidance.
- **Plan for backup continuity:** Maintain an independent backup of critical Microsoft 365 data so a single backup vendor outage does not leave gaps in recovery.
---
**Note on source limitations:** The article text provided is truncated, so the full "Indicators and tenant check" section and any additional IOCs or vendor guidance were not available. Verify details against the primary sources (ConnectWise advisory, Huntress, Todyl, and Microsoft Threat Intelligence) before operational use.