Compromised ConnectWise Cloud Backup Identities Used to Access Microsoft 365 Tenants
Summary
A compromised ConnectWise application credential was used to access customer Microsoft 365 tenants, conduct Graph reconnaissance, and attempt persistence. ConnectWise disabled affected identities; the investigation continues.
Key points
- ConnectWise disclosed unauthorized access involving application identities associated with Cloud Backup, formerly SkyKick, and disabled affected identities.
- Microsoft Threat Intelligence observed successful service-principal authentication and Microsoft Graph reconnaissance across customer tenants; Microsoft Graph itself was not compromised.
- Researchers reported attempts to add credentials to trusted applications and, in one tenant, a Cloud Management application assigned itself the Global Administrator role.
- Researchers identified unauthorized sign-ins in more than 160 tenants and later reported broader authentication activity across hundreds of Microsoft 365 environments.
- ConnectWise said it had not observed successful threat activity in environments it monitors after containment measures, as of October 19; the investigation remains active.
- Recommended reviews include affected applications, service-principal sign-ins, credentials, consent grants, role assignments, and access to Microsoft 365 resources.
Article Details
- Victim Organization
- ConnectWise customers with Microsoft 365 tenants
- Incident Type
- Compromise and abuse of ConnectWise Cloud Backup and Cloud Management application identities to access customer Microsoft 365 tenants
- Incident Date
- 2026-10-14
- Disclosure Date
- 2026-10-16
- Affected Records
- Unauthorized sign-ins were identified in more than 160 tenants; broader authentication activity was later reported across hundreds of Microsoft 365 environments. The article does not confirm how many records were accessed or exposed.
- Operational Impact
- ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services while containment, remediation, and forensic activities continued. Affected application identities were disabled or revoked. Researchers observed unauthorized access, Microsoft Graph reconnaissance, and persistence attempts, including successful credential creation in affected tenants. The full scope of downstream activity remains undetermined.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Vendors
Products
ConnectWise Cloud BackupConnectWise discovered unauthorized access involving application identities associated with ConnectWise Cloud Backup on October 14, disclosed the incident on October 16, and disabled affected application identities onConnectWise Cloud ManagementIn one tenant, a ConnectWise Cloud Management - MS Teams application assigned itself the Global Administrator role and added credentials to other trusted applications.Microsoft 365 Apps for Enterprisesuccessful authentication activity using the compromised application identity across customer Microsoft 365 tenants, followed by Microsoft Graph reconnaissance and attempts to establish persistence.Microsoft EntraReview Microsoft Entra service principal sign-in activity associated with affected application IDs.Microsoft Graphusing the compromised application identity across customer Microsoft 365 tenants, followed by Microsoft Graph reconnaissance and attempts to establish persistence.