Compromised ConnectWise Credential Used to Access 173 Microsoft 365 Tenants
Summary
Huntress observed unauthorized sign-ins to 173 Microsoft 365 tenants using a compromised ConnectWise Cloud Backup credential. ConnectWise disabled app access; it says it found no evidence backup data was compromised.
Key points
- Huntress reported confirmed unauthorized sign-ins in 173 partner and customer tenants where ConnectWise Cloud Backup was installed.
- The credential was used to obtain Microsoft Graph tokens, potentially granting access to mailboxes, files, Teams data, and directory information permitted by each tenant’s app consent.
- Huntress also described a separate incident in one tenant where a ConnectWise Teams app assigned itself Global Administrator privileges and added credentials to two other trusted applications.
- The same IP address was used in password-spraying attempts against four law firm tenants on October 13 and 14; Huntress reported no successful user sign-ins from those attempts in its telemetry.
- ConnectWise closed Cloud Backup application access until further notice and said it had found no evidence that partner backup data was compromised.
- Todyl warned that disabling the app stops new tokens, but already-issued tokens may remain valid for up to 90 minutes; tenants with the app enabled remain exposed until the credential is rotated.
- The article also reports a separate AOMEI Backupper update-infrastructure compromise, attributed to UNC7017, that delivered CROSSROAD and SHINYROAD malware during brief tampering windows between April and July 2026.
Article Details
- Victim Organization
- Organizations in partner/customer tenants where ConnectWise Cloud Backup was installed; specific organizations were not named
- Incident Type
- Unauthorized access using a compromised ConnectWise Cloud Backup credential, with confirmed sign-ins in 173 partner/customer tenants. A separate incident involved unauthorized privilege and credential changes in at least one partner tenant.
- Incident Date
- 2026-10-15
- Data Types Exposed
- Mailboxes and attachments
- OneDrive and SharePoint files
- Teams chats and data
- Directory information
- Affected Records
- 173 partner/customer tenants had confirmed unauthorized sign-ins. The number of affected records or individuals was not disclosed.
- Affected Data Size
- Unknown; the article describes access capabilities but does not confirm how much data was accessed or taken.
- Operational Impact
- ConnectWise closed Cloud Backup application access until further notice. The compromised credential could obtain tokens with the application's existing permissions. ConnectWise reported no evidence that Cloud Backup partner backup data had been compromised.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 144[.]172[.]64[.]128 | Source-reported attacker IP used for unauthorized sign-ins to customer tenants on October 15, 2026, and password spraying against four law firm tenants on October 13 and 14; no successful user sign-ins were detected for the password spraying. |
MITRE ATT&CK
T1053.005 · Scheduled TaskThe AOMEI supply-chain malware CROSSROAD was described as establishing persistence through scheduled tasks.T1098.001 · Additional Cloud CredentialsIn at least one partner tenant, an unauthorized ConnectWise app added new client secrets to two other applications.T1098.003 · Additional Cloud RolesIn at least one partner tenant, a separate ConnectWise app assigned itself Global Administrator privileges.T1110.003 · Password SprayingThe same reported IP address was used in password spraying against four law firm tenants on October 13 and 14, 2026.T1195.002 · Compromise Software Supply ChainThe AOMEI Backupper update infrastructure was tampered with to redirect software to a malicious ZIP package.T1574.002 · DLL Side-LoadingThe AOMEI supply-chain campaign used DLL sideloading to deploy SHINYROAD.
People
Jonathan SemonSecurity researcher quoted describing the compromised credential's use and the privilege and application-credential changes observed in a partner tenant.Nicholas KokenTodyl's head of Detection Engineering, quoted describing unauthorized authentication to Microsoft Graph as the ConnectWise Cloud Backup application.
Threat Actors
Malware
Vendors
AOMEIAnalysis Lab, detailed an "ephemeral supply chain tampering" of the update infrastructure belonging to AOMEI Backupper, a data backup, disk cloning, and disaster recovery software, to bypass traditional securityConnectWisein which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments.
Products
AOMEI BackupperLab, detailed an "ephemeral supply chain tampering" of the update infrastructure belonging to AOMEI Backupper, a data backup, disk cloning, and disaster recovery software, to bypass traditional security defensesConnectWise Cloud Backupunknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments.Microsoft 365 Apps for Enterprisethe alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized accessMicrosoft Graphcredential is in hostile hands," security researcher Jonathan Semon said. "It was used to obtain Microsoft Graph tokens in customer tenants from 144.172.64[.]128 on October 15, between 06:13 and 08:34 UTC. TheMicrosoft Teams"The ConnectWise Cloud Management app for Microsoft Teams (application ID 24205314-2b89-4e07-a2a4-579e898a5640) added itself to the Global Administrator role, then ran a Python script (User-Agent Python-urllib/3.12)
Countries
Australiarange of sectors, including IT services, telecommunications, higher education, and related entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the U.S.Brazilsectors, including IT services, telecommunications, higher education, and related entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the U.S.Indiaincluding IT services, telecommunications, higher education, and related entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the U.S.PakistanIT services, telecommunications, higher education, and related entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the U.S.Portugaltelecommunications, higher education, and related entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the U.S.Singaporehigher education, and related entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the U.S.South Africahigher education, and related entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the U.S.Spaineducation, and related entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the U.S.Switzerlandand related entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the U.S.Türkiyeentities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the U.S.
Industries
Higher Educationimpacted organizations spanning a wide range of sectors, including IT services, telecommunications, higher education, and related entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa,IT servicesThe campaign is assessed to have impacted organizations spanning a wide range of sectors, including IT services, telecommunications, higher education, and related entities in Australia, Brazil, India, Pakistan,Telecommunicationsis assessed to have impacted organizations spanning a wide range of sectors, including IT services, telecommunications, higher education, and related entities in Australia, Brazil, India, Pakistan, Portugal, Singapore,