ConnectWise Cloud Backup (SkyKick) app credentials abused in Microsoft 365 supply-chain attack; ~1,000 tenants probed, services suspended

Linha do tempo

1. infosecurity-magazine.com ↗ · pub. 19/10/2026 07:30 · coletado 20/10 16:31

   ConnectWise suspends Cloud Backup, SaaS Security and Cloud Management after attackers access Microsoft 365 application identities

   ler a análise desta fonte ocultar

   ConnectWise took several cloud services offline, including Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management, after finding unauthorized access to application identities in the ConnectWise Cloud Backup environment. The company began investigating suspicious activity on October 15 and confirmed the unauthorized access by October 17. Attackers could potentially use these application credentials to reach customers' Microsoft 365 tenants with the permissions granted to the backup app. Huntress observed that in at least one customer tenant the attacker assigned themselves the Global Administrator role and tried to change permissions for other applications. ConnectWise reports no indication yet that partner backup data was compromised, has no restoration time and declined to discuss attribution.

   Technical Details

   • The attacker authenticates as the application itself, using the tenant tooling the same way the backup service would, and obtains tokens carrying the app's existing permissions.
   • This is an application sign-in, so MFA does not apply. As Justin Kohler (SpecterOps) noted, no user, device or MFA prompt is involved.
   • Backup apps typically have broad read/restore access to mailboxes, OneDrive and SharePoint files, Teams data and directory information.
   • Huntress saw a Global Administrator role self-assigned in at least one tenant, followed by attempts to modify permissions of other applications, including an MSP management application and Huntress's own security application.
   • No attribution has been made, and no IOCs were published in the article.

   Remediation

   • Verify the status of the listed application connections and keep affected applications disabled until ConnectWise provides restoration instructions.
   • Preserve sign-in and audit records promptly, while taking any urgent containment action.
   • Review application and user authentication, application credentials, federation trusts, directory roles, owners, consent grants and recent policy changes.
   • Check for unauthorized mailbox forwarding, inbox or transport rules and delegated mailbox access.
   • Investigate other identities changed or used during suspicious activity; disabling the original applications does not remove those separate access paths.
2. huntress.com ↗ · pub. 16/10/2026 20:00 · coletado 20/10 16:30

   ConnectWise Cloud Backup (SkyKick) vendor credential abused to access 162+ Microsoft 365 tenants and plant persistence

   ler a análise desta fonte ocultar

   Huntress reports that a stolen vendor credential for ConnectWise Cloud Backup (formerly SkyKick) was used on October 15, 2026 to obtain Microsoft Graph tokens in customer Microsoft 365 tenants from the hosting IP 144.172.64[.]128. As of 19:00 UTC on October 16, Huntress had confirmed unauthorized sign-ins in 162 tenants. Later updates found almost 1,000 Entra tenants with sign-in activity from the IP, over 300 of them successful. The credential was a client assertion, so it lives in the vendor's own tenant and customers could not have caused the compromise. Post-compromise activity in two tenants was scripted and indiscriminate: the app granted itself Global Administrator and planted secrets on other applications, including Huntress's own app. Unauthorized secrets were added to a Huntress application in one customer tenant. ConnectWise acknowledged the incident and, per the October 17 update, disabled the relevant apps. Huntress also saw a second, targeted wave against 16 tenants in the policy, national security, trade and critical minerals sectors. No attribution is made.

   Technical Details

   • Timeline: Password spraying against four law firm tenants from the same IP on Oct 13-14 (curl/7.88.1; two accounts locked out). From 01:58 UTC on Oct 15, ConnectWise Cloud Management service principals assigned themselves directory roles (mostly Exchange Administrator) in ~50 tenants, using the vendor-typical kiota-dotnet user agent. Between 03:44 and 03:49 UTC, the Cloud Management MS Teams app added itself to Global Administrator in one tenant, then a Python script (Python-urllib/3.12) added client secrets (expiring 2028) to an MSP management app and the Huntress Security Platform app. A certificate addition failed with a thumbprint mismatch.
   • Token theft: Between 06:13 and 08:34 UTC, the app authenticated from 144.172.64[.]128, walking tenants in sorted GUID order, which indicates a script working from a target list. The last confirmed successful sign-in was at 08:44 UTC on Oct 15.
   • Targeted wave: On Oct 15 the actor swept 16 tenants for SkyKick Graph tokens (09:25-12:35 UTC). A second, apparently manual sweep (13:54-14:20 UTC) targeted Exchange Online, SharePoint, Teams, Azure Resource Manager, Entra and the O365 Management APIs. Attempts failed where the service principal was absent.
   • Post-compromise behavior: In two tenants, self-granted Global Administrator and secret planting occurred within two minutes of each other around 03:45 UTC on Oct 15. Target apps looked randomly chosen. Access from private Azure IPv6 space, not the known IP, was used to add the Huntress app credential. Huntress removed it on Oct 16 and enabled App Instance Property Lock on its apps.
   • Visibility gaps: Microsoft Graph directory reads leave no audit trail, and app-only audit events carry no source IP. No mailbox, file, user or policy changes were seen in the reviewed tenants, but data access cannot be ruled out.
   • ATT&CK mapping: T1078.004 (valid cloud accounts), T1098.003 (additional cloud roles), T1098.001 (additional cloud credentials).
   • Affected apps: ConnectWise Cloud Backup 506e08f9-6e9a-4da4-942b-a099a03644ae; Cloud Management 2399d300-6fca-4e6a-a686-399fefe75b83; MS Teams 24205314-2b89-4e07-a2a4-579e898a5640; Exchange Online b78f6a77-d4e5-46fb-87e5-d1648bd02519; MS Graph 0de14c77-b9b0-4137-9360-34878a929827; Partner Center 412dcf96-176d-4b3a-a1b0-4981ad66971e; SharePoint Online b2b55f5b-7758-4719-8d8f-88ae172e6bdb. Older tenants may show "SkyKick Cloud Manager".

   Remediation

   • Disable (do not delete) the ConnectWise/SkyKick enterprise applications in Entra, even if logs look clean. Deleting removes consent.
   • Review service principal sign-ins from roughly 01:00 UTC Oct 15 to 02:00 UTC Oct 16. Look for any non-Microsoft/Azure IP, especially 144.172.64[.]128.
   • Remove directory roles not intentionally granted to these apps, including Global Administrator and Privileged Authentication Administrator.
   • Audit client secrets and certificates on all enterprise apps and app registrations, especially MSP management and security tools, for any added since Oct 13. Remove unexpected ones.
   • Check Entra audit logs for "Add member to role", "Update application" and "Add service principal credentials" by these apps, and check user agents (kiota-dotnet is vendor-typical; Python-urllib/3.12 is not).
   • Review Conditional Access exclusions for these apps. Do not re-enable them until ConnectWise confirms all credentials are reset. Consider application management policies to restrict client secrets.
3. cyberscoop.com ↗ · pub. 20/10/2026 13:17 · coletado 20/10 14:00

   ConnectWise Cloud Backup supply-chain attack: compromised API secret used against hundreds of Microsoft 365 tenants

   ler a análise desta fonte ocultar

   A threat actor obtained a highly sensitive API secret for ConnectWise Cloud Backup (formerly SkyKick) and used it to sign in to customers' Microsoft 365 tenants, forcing ConnectWise to suspend its Cloud Backup, SaaS Security and Cloud Management services. Huntress saw sign-in activity from the malicious infrastructure across almost 1,000 Entra tenants, with more than 300 sign-ins appearing to succeed. It confirmed unauthorized sign-ins in 162 tenants and expects further compromises beyond its telemetry. The actor is unattributed and no one has claimed responsibility. ConnectWise has not explained how the credential was obtained and has given no restoration timeline.

   Technical Details

   • The credential belongs to a multi-tenant application, so anyone holding it can request access tokens in any tenant where the application is installed, with no customer action and bypassing MFA.
   • Affected Microsoft 365 workloads include Exchange Online, Teams, SharePoint Online, Cloud Backup, MS Graph and Partner Center. Todyl reports the access allowed reading and writing mail and files.
   • The sign-ins were performed by an automated tool. Microsoft Threat Intelligence observed broad successful sign-ins from a malicious IP address on Oct. 15.
   • Follow-on activity included Microsoft Graph API reconnaissance, privilege self-elevation by the application's account, and attempts to add credentials to the related service principal and other applications to keep backdoor access even after the original application is disabled.
   • Huntress saw the first wave on Friday. ConnectWise began mitigations on October 17 at 05:00 UTC and says it has seen no successful threat activity in the environments it monitors. It stresses that each partner or customer tenant still requires review.

   Remediation

   • Disable the affected ConnectWise applications in Microsoft 365 tenants even if logs show nothing unusual.
   • Hunt for malicious activity using the IOCs shared by ConnectWise and researchers.
   • Review service principals and application credentials for unexpected additions or privilege changes.
   • Review Entra sign-in logs and Graph API activity for the application identities.
4. thehackernews.com ↗ · pub. 20/10/2026 07:56 · coletado 20/10 10:00

   ConnectWise Cloud Backup Application Identities Compromised, Backdoored Entra Apps Seen in Microsoft 365 Tenants

   ler a análise desta fonte ocultar

   ConnectWise said it is still responding to a security incident involving unauthorized access to application identities tied to Cloud Backup. The incident was identified on October 14, 2026, and mitigations began rolling out on October 17. The company has disabled the affected application connections, suspended Cloud Backup, and suspended SaaS Security and Cloud Management as a precaution because both integrate with it. It has also reset accounts, replaced application credentials, strengthened administrative-access protections and engaged independent third-party incident responders. Huntress confirmed post-compromise activity in two Microsoft 365 tenants, where the application granted itself Global Administrator and planted new secrets on other applications for persistence. ConnectWise says it has seen no successful threat activity in the environments it monitors, and it has not established which partner or customer tenants are affected.

   Technical Details

   • Huntress reviewed application sign-ins across more than 10,000 tenants with ConnectWise applications. Only 144.172.64[.]128 and Microsoft-internal ranges produced application sign-in activity. The address was used with a vendor credential and is the primary vector.
   • Related addresses in the same provider range (AS14956, RouterHosting) showed password spray or failed logins, which Huntress considers unlikely to be related to the application sign-in activity: 144.172.64[.]99 (concentrated spray, October 10 to 14, 2026), 144.172.64[.]60 (a few failed logins, October 18) and 144.172.94[.]243 (broad, ongoing spray against many organizations).
   • In the second compromised tenant, the application granted itself Global Administrator and added a new secret to a small number of other applications registered in the tenant. Huntress found no apparent selection logic: two different sets of applications were chosen in the two tenants, regardless of what those applications could do.
   • Access may have been used for Microsoft Graph directory reads. There are no signs of mailbox or file manipulation, or of user or policy changes.

   Remediation

   • Do not reconnect affected applications until ConnectWise publishes formal restoration instructions.
   • Review each potentially affected Microsoft 365 tenant. Preserve evidence, validate findings and assess operational impact before making changes.
   • Use ConnectWise's published technical guidance to investigate partner and managed-customer environments. Look for unexpected Global Administrator grants and newly added application secrets.
   • Hunt for sign-ins from the listed IP addresses. A clean result does not guarantee a tenant is unaffected.
5. darkreading.com ↗ · pub. 19/10/2026 16:19 · coletado 19/10 19:00 só resumo do feed

   ConnectWise disables cloud backups as attackers reportedly use its credentials to authenticate into Microsoft 365 tenants

   ler a análise desta fonte ocultar

   ConnectWise has disabled its cloud backup offering amid concern for downstream managed service providers (MSPs) and their customers. Researchers say attackers authenticated into Microsoft 365 tenants using ConnectWise credentials. ConnectWise says customer impact remains unconfirmed. The available article text is limited to the headline and a short summary, so the initial access method, the scale of the compromise, any attribution and the affected product versions are not stated. Because MSP-linked credentials can give access to many downstream tenants, this is a potential supply-chain risk for MSP customers.

6. theregister.com ↗ · pub. 19/10/2026 01:31 · coletado 19/10 17:54

   ConnectWise suspends Cloud Backup, SaaS Security and Cloud Management after compromise of app identities; Huntress sees M365 tenant takeover

   ler a análise desta fonte ocultar

   ConnectWise disclosed on October 16 that on October 15 it detected unauthorized access to application identities in its Cloud Backup (formerly SkyKick) environment. It suspended Cloud Backup, plus the integrated SaaS Security and Cloud Management services, as a precaution. As of 16:00 UTC on October 18 the services were still down, so end users cannot back up, access or restore data. Huntress says a Microsoft 365 credential (API secret) belonging to ConnectWise Cloud Backup was compromised and is being used to access customers' M365 environments. ConnectWise has not discussed attribution and says existing archives remain encrypted, isolated and show no evidence of unauthorized access.

   Technical Details

   • Huntress observed, in one partner tenant, the ConnectWise application Cloud Management - MS Teams (Application ID 24205314-2b89-4e07-a2a4-579e898a5640) grant itself Global Administrator. It then added new credentials to two other applications in that tenant, one of them a single-tenant Huntress application.
   • Disabling the abused M365 apps does not remove credentials that were already added.
   • ConnectWise published IOCs tied to a handful of IP addresses and third-party app integrations; the article does not list them. It also disabled some integrations between Cloud Backup and Exchange, Teams, SharePoint Online and its own products.
   • The downstream exposure is hard to scope because ConnectWise does not know which M365 tenants its MSP partners manage, and end-user organizations may not know an MSP uses ConnectWise.

   Remediation

   • Review the credentials on all M365 applications, not just the ConnectWise ones, and remove any unrecognized ones.
   • MSPs should check the M365 environments they manage for signs of compromise, using the IOCs published by ConnectWise.
   • Disabling the ConnectWise apps alone is not sufficient.
7. securityaffairs.com ↗ · pub. 19/10/2026 06:32 · coletado 19/10 17:54

   Stolen ConnectWise Cloud Backup app credentials used to access Microsoft 365 tenants; services suspended

   ler a análise desta fonte ocultar

   ConnectWise suspended its Cloud Backup (formerly SkyKick) service and took SaaS Security and Cloud Management offline after unknown attackers obtained unauthorized access to seven of its application identities. The company detected the incident on October 14, disabled the compromised identities on October 17, and is still investigating how the credentials were obtained. Because the applications already held permissions in customer Microsoft 365 tenants, the attackers could impersonate them and request tokens from Microsoft Entra ID without needing any customer passwords. Huntress observed malicious sign-ins from 144.172.64.128 and a later manual, targeted wave against 16 tenants in the policy, national security, trade and critical minerals sectors, all of which failed.

   Technical Details

   • Depending on granted permissions, attackers could reach mailboxes, SharePoint documents, Teams messages and directory data.
   • Huntress saw malicious sign-ins from 144.172.64[.]128 through October 15 at about 14:20 UTC. A second, apparently manual wave hit Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra and Office 365 Management APIs in rapid succession; all 16 attempts failed.
   • Of about 1,000 Entra tenants with sign-in activity from the suspicious IP, around 300 sign-ins succeeded. Some could not proceed because the required service principal was missing in the tenant.
   • Persistence risk: an attacker could add a client secret to another trusted application or create a new application and grant it permissions. In one tenant, an application able to assign directory roles could make itself Global Administrator, allowing it to add credentials, reset passwords and authentication methods, and change Conditional Access policies.
   • ConnectWise revoked the certificates used for affected application connections. This stops new authentication but does not reverse changes already made in a tenant.
   • ConnectWise says Cloud Backup archives remain encrypted and isolated, with no evidence they were accessed. Backups are not running and restores are unavailable while the service is suspended.

   Remediation

   • Review your own and every managed customer Microsoft 365 tenant, including those with dormant SkyKick connections, for sign-ins from 144.172.64[.]128 starting October 13.
   • Preserve sign-in and audit logs before containment, since containment steps can overwrite evidence.
   • Check application credentials and federation trusts, directory role assignments, consent grants, recent policy changes, mailbox forwarding rules and delegated mailbox access.
   • Rotating the vendor credential is necessary but not sufficient, because attackers may have created alternate access paths.
8. gbhackers.com ↗ · pub. 17/10/2026 09:27 · coletado 19/10 17:54

   ConnectWise Cloud Backup (SkyKick) credentials abused to access 162 Microsoft 365 tenants; backup service access shut off

   ler a análise desta fonte ocultar

   Attackers used compromised application credentials from ConnectWise Cloud Backup (formerly SkyKick) to access Microsoft 365 customer environments. Huntress researcher Jonathan Semon confirmed unauthorized sign-ins across 162 tenants as of 19:00 UTC on October 16. ConnectWise disabled application access, which interrupted backup services, and said it has no indicators that stored partner backup data was compromised. Data theft is unconfirmed, but the application holds broad permissions, so exposure may extend to every organization that has consented to it.

   Technical Details

   • On October 15, between 06:13 and 08:34 UTC, the attacker used the compromised application credential to obtain Microsoft Graph tokens from hosting-provider IP 144.172.64[.]128. Requests moved through tenants in sorted identifier order, seconds apart, which suggests automated targeting.
   • Authenticating as the trusted application meant inheriting the permissions already approved in each tenant. The application covers Microsoft 365 mailboxes, OneDrive, SharePoint, Teams and directory information.
   • In one partner tenant, a second application, ConnectWise Cloud Management – MS Teams, assigned itself Global Administrator and then added client secrets to two other applications: an MSP management application and a partner-specific Huntress Security Platform application. The secrets were set to expire in 2028, giving persistence independent of the original credential.
   • These changes happened about 2.5 hours before the observed public-IP authentications. Huntress has not established that both activity sequences involved the same operator. A logged private IPv6 address cannot identify the operator.
   • Absence of visible mailbox or file activity does not prove safety, because directory reads lack audit visibility.

   Remediation

   • Disable, rather than delete, ConnectWise Cloud Backup application 506e08f9-6e9a-4da4-942b-a099a03644ae and Cloud Management – MS Teams application 24205314-2b89-4e07-a2a4-579e898a5640. Review other ConnectWise applications.
   • Inspect Microsoft Entra service principal sign-in logs for suspicious authentication, including from 144.172.64[.]128. Investigate unexpected directory-role assignments and application modifications.
   • Review client secrets and certificates across application registrations and enterprise applications. Remove unauthorized credentials added since October 13 and revoke unexpected privileges, since disabling the vendor applications does not remove planted secrets.
   • Keep affected applications disabled until ConnectWise confirms credential resets. Existing stored backups are not deleted, but plan for the backup interruption.
9. securityweek.com ↗ · pub. 19/10/2026 10:16 · coletado 19/10 17:53

   ConnectWise suspends cloud services after compromised Cloud Backup credential used to access hundreds of Microsoft 365 tenants

   ler a análise desta fonte ocultar

   ConnectWise suspended its Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management services on October 17-18 after attackers abused a compromised application credential to access customers' Microsoft 365 tenants. Huntress saw the Cloud Backup identity sign in to 162 M365 tenants between October 15 and 16. By October 17 it had found sign-ins from the attacker's IP in nearly 1,000 Entra tenants, with more than 300 successful. ConnectWise says customer backups remain encrypted and it has no evidence they were accessed. It has given no restoration timeline, so scheduled backups, restores, monitoring and license management remain disrupted.

   Technical Details

   • The credential type was a client assertion, meaning it lives in the vendor's own tenant and customer actions could not have produced it (per Huntress).
   • The source IP 144.172.64[.]128 obtained Microsoft Graph tokens in customer tenants on October 15 between 06:13 and 08:34 UTC. The actor moved through tenants in sorted GUID order, which suggests a script working from a target list.
   • The same IP was used October 13-14 in password spraying and scripted sign-in attempts against four law firm tenants.
   • In one tenant, the ConnectWise Cloud Management app for Microsoft Teams added itself to the Global Administrator role on October 15. It then ran a Python script that added client secrets to an MSP management application and to Huntress's own application. This came from Microsoft's internal cloud network about 2.5 hours before the first sign-ins from the attacker IP. Huntress has not tied the two phases to the same operator.
   • Huntress is highly confident the actor also abused the Cloud Management Exchange Online, MS Teams and SharePoint Online applications. ConnectWise has shut all three down.
   • Sign-ins succeeded only where the relevant ConnectWise service principal existed in the tenant.

   Remediation

   • Review M365/Entra tenants for sign-ins from the published IP addresses and for activity by the ConnectWise service principals.
   • Check for unexpected Global Administrator role assignments, new client secrets and other configuration changes or persistence. ConnectWise has published guidance for reviewing MSP Microsoft 365 environments.
   • Do not assume Microsoft backs up tenant configuration automatically.
10. bleepingcomputer.com ↗ · pub. 17/10/2026 12:18 · coletado 19/10 17:53

    ConnectWise Cloud Backup (SkyKick) supply-chain attack abuses service principals to breach Microsoft 365 tenants

    ler a análise desta fonte ocultar

    ConnectWise shut down its Cloud Backup service (formerly SkyKick Cloud Backup) after an attacker gained unauthorized access to application identities and used them to compromise Microsoft 365 tenants. Huntress identified at least 162 compromised tenants in its environment, and Microsoft Threat Intelligence characterized the incident as an active supply-chain attack. Activity began at least on October 13-15, 2026, from a single IP address, 144.172.64[.]128. The victim count, the extent of data theft and the way the attacker obtained the vendor credentials remain unclear. As of October 18, Cloud Backup, SaaS Security and Cloud Management remain offline, and ConnectWise reports no evidence that stored backup archives were compromised.

    Technical Details

    • The attacker authenticated directly to Microsoft 365 as the backup application using its secret, via automated scripts. These were non-interactive service principal sign-ins, so MFA was ineffective.
    • The app's previously granted permissions (Microsoft assesses this likely included Directory.ReadWrite.All) allowed reading and writing mail, OneDrive/SharePoint files and Teams chats.
    • Huntress saw ConnectWise Cloud Management service principals (Exchange Online, Teams, Graph) assign themselves directory roles, mostly Exchange Administrator, in nearly 50 tenants. In one tenant, "Cloud Management - MS Teams" granted itself Global Administrator and added credentials to an MSP management tool and to Huntress's own application, in about five minutes.
    • Microsoft observed backdoor persistence, Microsoft Graph API reconnaissance and attempts to add further credentials. Todyl found only sign-in activity in nine tenants it analyzed.
    • Source IP: 144.172.64[.]128, also linked to scripted sign-ins on October 13-14 with user agent curl/7.88.1. Other user agents: python-urllib/3.12, python-requests/2.31, python-requests/2.34.2.
    • Legitimate Cloud Backup app ID abused: 506e08f9-6e9a-4da4-942b-a099a03644ae. Other ConnectWise Cloud Management app IDs to check are listed in the IOC field.

    Remediation

    • Review service principal sign-ins in Entra filtered by the Cloud Backup application ID, and look for unexpected source addresses.
    • Disable the implicated ConnectWise applications. Older tenants may list them as "SkyKick Cloud Manager".
    • Review secrets and certificates across all applications for unauthorized additions since October 13 and remove them. The vendor shutdown does not remove credentials already planted in tenants.
    • Review application credential changes, OAuth grants, directory role assignments and Graph activity.
    • Existing tokens remain valid until they expire, and revoking user sessions does not end application-based access.
11. thehackernews.com ↗ · pub. 17/10/2026 03:16 · coletado 19/10 17:53

    Compromised ConnectWise Cloud Backup (SkyKick) OAuth app credential used to access 173+ Microsoft 365 tenants

    ler a análise desta fonte ocultar

    An active supply chain attack is abusing a compromised credential for the ConnectWise Cloud Backup (formerly SkyKick) Microsoft 365 OAuth application, giving unknown actors access to customer tenants. Huntress confirmed unauthorized sign-ins in 173 partner/customer tenants, and Microsoft reports broad successful service principal authentication on October 15, 2026 from 144.172.64[.]128. The app holds broad consented permissions (mailboxes, OneDrive, SharePoint, Teams, directory data), so the attacker inherits that access in every tenant where it is installed. ConnectWise has shut off Cloud Backup application access and says it has found no evidence that partner backup data was compromised; the investigation is ongoing. The article also briefly covers a separate campaign: the UNC7017 tampering of AOMEI Backupper update infrastructure to deliver CROSSROAD and SHINYROAD.

    Technical Details

    • The actor authenticated as the app using its own tooling and obtained Microsoft Graph tokens from 144.172.64[.]128 on October 15 between 06:13 and 08:34 UTC, moving through tenants in sorted GUID order a few seconds apart, which suggests a script working from a target list.
    • The same IP password-sprayed four law firm tenants on October 13-14, 2026; Huntress saw no successful user sign-ins.
    • In at least one partner tenant, the ConnectWise Cloud Management app for Teams (24205314-2b89-4e07-a2a4-579e898a5640) added itself to Global Administrator, then ran a Python script (User-Agent Python-urllib/3.12) that added new client secrets to an MSP management application and to Huntress's own application.
    • Microsoft assesses that privileged permissions such as Directory.ReadWrite.All were likely abused, with follow-on Graph API reconnaissance and attempts to add credentials to the related service principal as a backdoor.
    • Todyl notes the consent allows read/write to mail (full mailbox via EWS), OneDrive/SharePoint, and Teams chats, including restore. Revoking user sessions does not end access; already-issued tokens stay valid up to 90 minutes. Some directory reads via Graph leave no audit trail.
    • Huntress observed a possible affinity for alphabetical targeting (victims starting with 'A').
    • AOMEI Backupper (April-July 2026): per Google Mandiant/GTIG and ManageEngine, 5-10 minute tampering windows redirected the updater to a malicious ZIP from attacker servers. It contained the CROSSROAD downloader, which uses scheduled-task persistence to deploy the SHINYROAD modular backdoor via DLL sideloading. Victims spanned IT services, telecoms and higher education in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the U.S.

    Remediation

    • Disable the ConnectWise Cloud Backup app in tenants until ConnectWise confirms all credentials are reset.
    • Enable Microsoft Graph activity logs.
    • In Entra sign-in logs (Service principal sign-ins tab), filter by AppId 506e08f9-6e9a-4da4-942b-a099a03644ae and review sign-ins from IPs outside expected Microsoft/Azure ranges; normal egress is Azure private IPv6.
    • Audit for credentials added to applications since October 13, 2026, OAuth grant changes, and ConnectWise/SkyKick apps adding themselves to directory roles.
    • Block 144.172.64[.]128 and review the listed ConnectWise Cloud Management application IDs.
12. thehackernews.com ↗ · pub. 18/10/2026 05:23 · coletado 19/10 17:53 primeiro registro

    ConnectWise application identities compromised, enabling attacker access to Microsoft 365 tenants; Cloud Backup suspended

    ler a análise desta fonte ocultar

    ConnectWise disabled seven application identities on October 17, 2026 after unknown threat actors gained unauthorized access to them and used them to compromise Microsoft 365 tenants. The company detected the issue on October 14 and has suspended Cloud Backup, SaaS Security and Cloud Management while it investigates. Huntress observed almost 1,000 Entra tenants with sign-in activity from 144.172.64[.]128, about 300 of them successful. It also reported a second, targeted wave against 16 tenants in the policy, national security, trade and critical mineral sectors, which was unsuccessful. The root cause is unknown, and ConnectWise says it is unclear whether a product vulnerability contributed to the credential exposure.

    Technical Details

    • The attacker authenticated as the ConnectWise applications and requested access tokens from Microsoft Entra ID. This gave access to mailboxes, SharePoint documents, Teams messages and directory data without stealing individual customer passwords.
    • Post-compromise actions described include adding the application to the Global Administrator role, adding client secrets to other trusted applications, and creating new applications with granted permissions. Planted secrets give persistence even after the original credential is revoked.
    • Disabled identities: ConnectWise Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae) and six Cloud Management apps (general, MS Teams, Exchange Online, MS Graph, Partner Center, SharePoint Online).
    • Huntress has high confidence the actor also targeted the Cloud Management apps for Exchange Online, Teams and SharePoint, and confirmed abuse of the Teams app in one tenant. Those apps were reportedly not disabled by ConnectWise.
    • The October 15 targeted activity included a sweep for Graph tokens from the SkyKick app (09:25-12:35 UTC) and a manual sweep (13:54-14:20 UTC) against Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra and the Office 365 Management APIs.
    • Some tenants were protected because no service principal existed, even when sign-ins succeeded.
    • Previously issued access tokens may remain valid until they expire. Revoking the connections does not reverse changes already made inside a tenant.
    • ConnectWise says existing backup archives remain encrypted and isolated, with no evidence they were accessed.

    Remediation

    • Review the partner's own tenant and every managed customer tenant, including those with dormant SkyKick connections.
    • Keep the affected applications disabled until further notice.
    • Review sign-ins from October 13, 2026 onward for activity from 144.172.64[.]128.
    • Preserve sign-in and audit logs before containment.
    • Review application credentials, federation trusts, directory roles, owners, consent grants and recent policy changes.
    • Check for unauthorized mailbox forwarding, inbox or transport rules, and delegated mailbox access.
    • Investigate any other identities changed or used during suspicious activity.
    • Use Entra application management policies to restrict client secrets and cap credential lifetimes.
    • Limit who holds the Application Administrator and Cloud Application Administrator roles.
    • Use Conditional Access for workload identities (requires extra licensing) and Entra ID Protection to flag risky service principals.