ConnectWise Cloud Backup Attack Compromises Microsoft 365 Tenants
Summary
ConnectWise shut down Cloud Backup after attackers abused application identities to access Microsoft 365 tenants. Huntress identified at least 162 compromised tenants; the victim count and extent of data theft remain unclear.
Key points
- Microsoft confirmed unauthorized authentication attempts on October 15, while administrators reported suspicious activity beginning at least October 13.
- The attacker authenticated as the backup application using its existing secret and customer-granted permissions; automated sign-ins bypassed user-based MFA.
- The permissions could enable access to mail, attachments, OneDrive and SharePoint files, and Teams chats.
- Huntress identified at least 162 compromised tenants and observed self-assigned directory roles in nearly 50 monitored tenants.
- Microsoft and Huntress observed persistence attempts, including added credentials; Todyl found no persistence evidence in its analysis of nine tenants.
- ConnectWise disabled application access and is investigating. It said there were no indicators that stored backup data was compromised.
- Admins are advised to review service-principal sign-ins, application credentials, OAuth grants, and Graph activity, and remove unauthorized credentials; disabling an app may not immediately invalidate existing tokens.
Article Details
- Victim Organization
- ConnectWise and affected customer organizations, which were not individually identified
- Incident Type
- Supply-chain attack involving unauthorized access to ConnectWise Cloud Backup application identities and compromise of Microsoft 365 customer tenants
- Incident Date
- 2026-10-15
- Disclosure Date
- 2026-10-17
- Data Types Exposed
- Email and attachments
- OneDrive and SharePoint files
- Teams chats
- Affected Records
- Unknown; Huntress reported at least 162 compromised tenants in its environment, while the overall victim count remained unclear.
- Affected Data Size
- Unknown
- Operational Impact
- ConnectWise shut down partner and client access to Cloud Backup. The service interruption was announced on October 17; no restoration timeline was provided. ConnectWise said existing backup archives were not impacted and would be accessible after service restoration.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 144[.]172[.]64[.]128 | Source IP address linked by Microsoft, Huntress, and Todyl to malicious automated sign-ins and other activity in the incident. |
MITRE ATT&CK
T1078.004 · Cloud AccountsThe attacker authenticated to Microsoft 365 using the backup application's existing credentials and permissions.T1098.001 · Additional Cloud CredentialsMicrosoft observed attempts to add credentials, and Huntress observed credentials added to applications in one tenant.T1098.003 · Additional Cloud RolesHuntress observed service principals assigning themselves directory roles, mostly Exchange Administrator; in one tenant, an application granted itself Global Administrator.T1526 · Cloud Service DiscoveryMicrosoft observed Microsoft Graph API reconnaissance following service-principal authentication.
Vendors
ConnectWiseHackers breach Microsoft 365 tenants via ConnectWise supply-chain attackHuntressLater on the same day, managed cybersecurity and threat detection platform Huntress confirmed the worries, saying that it had identified at least 162 compromised tenants in its environment.MicrosoftHackers breach Microsoft 365 tenants via ConnectWise supply-chain attackTodylNevertheless, some of the reported IDs for the offensive SkyKick match those provided by Huntress, Microsoft, and Todyl - a cybersecurity platform primarily for MSPs and IT professionals.
Products
Cloud ManagementHowever, Huntress saw on nearly 50 tenants it monitors that service principals for “ConnectWise’s Cloud Management apps (Exchange Online, Microsoft Teams, and Microsoft Graph) assigned themselves directory roles, mostlyConnectWise Cloud BackupConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants.Microsoft 365 Apps for EnterpriseHackers breach Microsoft 365 tenants via ConnectWise supply-chain attackMicrosoft Entra IDFor Microsoft 365 backups, the service relies on permissions granted through Microsoft Entra ID.Microsoft Graphservice principals for “ConnectWise’s Cloud Management apps (Exchange Online, Microsoft Teams, and Microsoft Graph) assigned themselves directory roles, mostly Exchange Administrator.”