/
← Voltar ao feed
critical managed_service_providers legal technology

ConnectWise suspends cloud services after compromised Cloud Backup credential used to access hundreds of Microsoft 365 tenants

1 fonte(s) · 1 atualização(ões) · publicado 19/10/2026 10:16 · coletado há 1 dia

ConnectWise suspended its Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management services on October 17-18 after attackers abused a compromised application credential to access customers' Microsoft 365 tenants. Huntress saw the Cloud Backup identity sign in to 162 M365 tenants between October 15 and 16. By October 17 it had found sign-ins from the attacker's IP in nearly 1,000 Entra tenants, with more than 300 successful. ConnectWise says customer backups remain encrypted and it has no evidence they were accessed. It has given no restoration timeline, so scheduled backups, restores, monitoring and license management remain disrupted.

Technical Details

  • The credential type was a client assertion, meaning it lives in the vendor's own tenant and customer actions could not have produced it (per Huntress).
  • The source IP 144.172.64[.]128 obtained Microsoft Graph tokens in customer tenants on October 15 between 06:13 and 08:34 UTC. The actor moved through tenants in sorted GUID order, which suggests a script working from a target list.
  • The same IP was used October 13-14 in password spraying and scripted sign-in attempts against four law firm tenants.
  • In one tenant, the ConnectWise Cloud Management app for Microsoft Teams added itself to the Global Administrator role on October 15. It then ran a Python script that added client secrets to an MSP management application and to Huntress's own application. This came from Microsoft's internal cloud network about 2.5 hours before the first sign-ins from the attacker IP. Huntress has not tied the two phases to the same operator.
  • Huntress is highly confident the actor also abused the Cloud Management Exchange Online, MS Teams and SharePoint Online applications. ConnectWise has shut all three down.
  • Sign-ins succeeded only where the relevant ConnectWise service principal existed in the tenant.

Remediation

  • Review M365/Entra tenants for sign-ins from the published IP addresses and for activity by the ConnectWise service principals.
  • Check for unexpected Global Administrator role assignments, new client secrets and other configuration changes or persistence. ConnectWise has published guidance for reviewing MSP Microsoft 365 environments.
  • Do not assume Microsoft backs up tenant configuration automatically.

Linha do tempo

  1. securityweek.com ↗ · pub. 19/10/2026 10:16 · coletado 19/10 17:53 primeiro registro

    ConnectWise suspends cloud services after compromised Cloud Backup credential used to access hundreds of Microsoft 365 tenants

    ler a análise desta fonte

    ConnectWise suspended its Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management services on October 17-18 after attackers abused a compromised application credential to access customers' Microsoft 365 tenants. Huntress saw the Cloud Backup identity sign in to 162 M365 tenants between October 15 and 16. By October 17 it had found sign-ins from the attacker's IP in nearly 1,000 Entra tenants, with more than 300 successful. ConnectWise says customer backups remain encrypted and it has no evidence they were accessed. It has given no restoration timeline, so scheduled backups, restores, monitoring and license management remain disrupted.

    Technical Details

    • The credential type was a client assertion, meaning it lives in the vendor's own tenant and customer actions could not have produced it (per Huntress).
    • The source IP 144.172.64[.]128 obtained Microsoft Graph tokens in customer tenants on October 15 between 06:13 and 08:34 UTC. The actor moved through tenants in sorted GUID order, which suggests a script working from a target list.
    • The same IP was used October 13-14 in password spraying and scripted sign-in attempts against four law firm tenants.
    • In one tenant, the ConnectWise Cloud Management app for Microsoft Teams added itself to the Global Administrator role on October 15. It then ran a Python script that added client secrets to an MSP management application and to Huntress's own application. This came from Microsoft's internal cloud network about 2.5 hours before the first sign-ins from the attacker IP. Huntress has not tied the two phases to the same operator.
    • Huntress is highly confident the actor also abused the Cloud Management Exchange Online, MS Teams and SharePoint Online applications. ConnectWise has shut all three down.
    • Sign-ins succeeded only where the relevant ConnectWise service principal existed in the tenant.

    Remediation

    • Review M365/Entra tenants for sign-ins from the published IP addresses and for activity by the ConnectWise service principals.
    • Check for unexpected Global Administrator role assignments, new client secrets and other configuration changes or persistence. ConnectWise has published guidance for reviewing MSP Microsoft 365 environments.
    • Do not assume Microsoft backs up tenant configuration automatically.