ConnectWise Cloud Backup App Abused to Request Microsoft 365 Tenant Tokens
Summary
Sophos researchers found a 96-minute automated sweep using the ConnectWise Cloud Backup app identity to request Microsoft Graph tokens across consenting tenants. The credential’s origin and how tokens were used remain unknown.
Key points
- On October 15, 2026, an actor used the ConnectWise Cloud Backup application identity to request app-only Microsoft Graph tokens from customer Microsoft 365 tenants.
- The requests required no user password or MFA; Sophos says the activity is consistent with abuse of a compromised vendor-held application credential, but how it was obtained is unknown.
- The sweep ran for about 96 minutes from a single VPS. Ascending tenant GUIDs, one-to-six-minute intervals, and inclusion of tenants without active subscriptions pointed to scripted enumeration.
- Sophos found no evidence of hands-on-keyboard activity or of the application creating new secrets, applications, consents, or role assignments in reviewed tenants.
- It remains unclear what the actor did with the requested tokens.
- ConnectWise disabled Cloud Backup application access for partners and customers as a protective measure.
- Sophos recommends reviewing and removing disabled app consents, checking Entra sign-in and audit logs, reviewing available Graph activity logs, and following the vendor’s remediation and credential-rotation guidance.
Article Details
- Victim Organization
- Microsoft 365 customer tenants that had consented to the ConnectWise Cloud Backup application
- Incident Type
- Cross-tenant automated token sweep using the ConnectWise Cloud Backup application identity
- Incident Date
- 2026-10-15
- Operational Impact
- ConnectWise shut off Cloud Backup application access for partners and customers as a protective measure. The article reports no evidence of what the threat actor did with the requested tokens.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 144[.]172[.]64[.]128 | Source of the observed token sweep in the ConnectWise incident. |
| IPV4 | 144[.]172[.]64[.]60 | Attacker infrastructure reported by the vendor; not observed in Sophos telemetry. |
| IPV4 | 144[.]172[.]64[.]99 | Attacker infrastructure reported by the vendor; not observed in Sophos telemetry. |
Vendors
ConnectWiseidentified a series of service principal sign-ins in which a threat actor authenticated as the ConnectWise Cloud Backup application (formerly SkyKick) and requested app-only Microsoft Graph tokens from customerMicrosoftauthenticated as the ConnectWise Cloud Backup application (formerly SkyKick) and requested app-only Microsoft Graph tokens from customer Microsoft 365 tenants. The malicious scanning activity originated from a
Products
ConnectWise Cloud Backupidentified a series of service principal sign-ins in which a threat actor authenticated as the ConnectWise Cloud Backup application (formerly SkyKick) and requested app-only Microsoft Graph tokens from customerEntraConnectWise Cloud Backup is a Microsoft 365 product that operates through a multi-tenant Entra application. When a customer enables the product, they consent to the application in their tenant. This consent allows theMicrosoft 365 Apps for EnterpriseBackup application (formerly SkyKick) and requested app-only Microsoft Graph tokens from customer Microsoft 365 tenants. The malicious scanning activity originated from a single virtual private server (VPS) andMicrosoft Graphauthenticated as the ConnectWise Cloud Backup application (formerly SkyKick) and requested app-only Microsoft Graph tokens from customer Microsoft 365 tenants. The malicious scanning activity originated from a singleSkyKicksign-ins in which a threat actor authenticated as the ConnectWise Cloud Backup application (formerly SkyKick) and requested app-only Microsoft Graph tokens from customer Microsoft 365 tenants. The malicious