Cybersecurity researchers are raising the alarm regarding an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers’ M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs) to protect their customers’ Microsoft 365 or Google Workspace data. To perform its tasks, the app has extensive access to mailboxes, OneDrive, SharePoint, Teams, and directory data in each tenant in which it is installed. Huntress said it has observed confirmed unauthorized logins within 173 partner/customer tenants using the compromised vendor credential. The incident affects all organizations that have the app installed, and the credential works against all tenants to which the app is authorized. “The app’s credential is in hostile hands,” said security researcher Jonathan Semon. “Used to obtain Microsoft Graph tokens on customer tenants of 144.172.64[.]128 on October 15, between 06:13 and 08:34 UTC. The actor moved through the tenants in GUID order, within a few seconds of each other, pointing to a script running from a list of targets.” In the observed attackers, it has been observed that the adversary authenticates to the application using its own tools, analogous to the backup service, and obtains tokens with the application’s existing permissions. Since the application has broad permissions to access client data, an attacker in possession of the tokens can read mailboxes. mail, files and directory data that the backup service can read. said the same IP address was involved in password spraying against four law firm tenants on October 13 and 14, 2026, although it said it did not detect any successful user logins in its telemetry. In at least one associated tenant, the cybersecurity company said it found a separate ConnectWise application that was assigning Global Administrator privileges and adding credentials to other trusted applications within this environment. thus opening a path to other privileged applications within the client environments. This effectively extends the risk beyond the provider account. For Microsoft Teams (Application ID 24205314-2b89-4e07-a2a4-579e898a5640) was added to the Global Administrator role, it then ran a Python script (User-Agent Python-urllib/3.12) that modified two other applications in the tenant: an MSP management application and the Huntress application itself (Huntress Security Platform), adding new client secrets to both”, Semon “The two applications that received new secrets are privileged and trusted tools. Adding a credential to an MSP management application can extend access beyond one tenant, because those applications often receive consent from the tenants of the MSP’s clients. Todyl, in a similar analysis, said it detected an unauthorized party authenticating to Microsoft Graph as the ConnectWise Cloud Backup application. “Access inherited the existing app consent, which allows read/write access to mail and attachments (full mailbox access via Exchange Web Services), OneDrive and SharePoint files, and Teams chats, including the ability to restore data,” Nicholas Koken, director at Todyl. of Discovery Engineering, said: “Revoking user sessions does not terminate this access. Disabling the app in a tenant prevents new tokens from being issued there, although already issued tokens remain valid for up to 90 minutes. Any tenant where the app is still enabled remains exposed until ConnectWise rotates the credential.” In response to the incident, ConnectWise took the action of closing access to the Cloud Backup application until further notice. The company said it found no evidence that the Cloud Backup partner’s backup data was compromised. He also shared the following steps to look for indicators of compromise: In the Microsoft Admin Center Log in, navigate to Monitoring → Logon Logs, select the Service Principal Logons tab, and filter by Application ID. 506e08f9-6e9a-4da4-942b-a099a03644ae. The default user logins tab will not display the required information. In the IP address column, review authentication activity originating from IP addresses outside of the expected Microsoft/Azure ranges. The normal output of the application was identified as Azure private IP address: 144.172.64.[.]128 “The backup service needs broad access to do its job, and an attacker using your credentials will inherit that level of access for each tenant where the application is installed,” Huntress explained. “Depending on permissions in the tenant, that can include mailboxes, OneDrive and SharePoint files, Teams data, and directory information, much of which belongs to your customers. Some of that access, such as directory reads through Microsoft Graph, leaves no audit trail, so we suggest acting now rather than waiting for an access test. The full potential impact depends on the permissions in play on each tenant.” Users are recommended to disable the app until ConnectWise confirms that all credentials have been reset, enables Microsoft Graph activity logs, audits new credentials added since October 13, 2026, and checks Entra audit logs for ConnectWise or SkyKick apps that are added to a directory role. The development comes as Google’s Mandiant and Google Threat Intelligence Group, along with ManageEngine Threat Analysis Lab, detailed an “ephemeral supply chain manipulation” of update infrastructure belonging to AOMEI Backupper, a data backup, disk cloning and disaster recovery software, to bypass traditional security defenses and deliver malware such as CROSSROAD and SHINYROAD. “The threat actor performed repeated, brief configuration manipulations against AOMEI’s origin servers,” Google said. “Each tamper window remained active for only five to ten minutes before reverting to authentic versions. During the brief tamper windows, the threat actor modified the update configuration file on the update server to redirect the software and download a malicious ZIP package from servers controlled by the attacker instead of legitimate updates.” The ZIP file contains CROSSROAD, an initial downloader responsible for environment validation and preparation of follow-up payloads. It is also designed to establish scheduled task-based persistence to implement SHINYROAD, a modular backdoor framework for covert command and control, via DLL download. The software supply chain compromise campaign, which occurred between April and July 2026, has been attributed to a previously undocumented threat group codenamed UNC7017. The activity marks the first time that such a commit has occurred in short intervals rather than maintaining a static, persistent modification on servers. The campaign is believed to have impacted organizations spanning a wide range of sectors, including IT services, telecommunications, higher education and related entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Turkey and the US. An active supply chain attack In a post on 506e08f9-6e9a-4da4-942b-a099a03644ae), formerly SkyKick Backup, to obtain access tokens between customer tenants.” The tech giant said the threat actor likely abused permissions previously granted by customers to the app, including highly privileged permissions like Directory.ReadWrite.All. “On October 15, 2026, we observed a successful broad service principal authentication originating from IP address 144.172.64.[.]128,” it added. “Tracking activity included Microsoft Graph API recognition and attempts to add additional credentials to the related service principal in the target tenants to maintain direct access as a backdoor.” Microsoft recommends that security teams review service principal logins from unrecognized IP addresses, application credential changes, and OAuth grant activity associated with the aforementioned OAuth AppId. ConnectWise, in a separate advisory, confirmed that it has identified unauthorized access to user identities. applications within the ConnectWise Cloud Backup environment has closed access to the Cloud Backup application while its “investigation and remediation efforts remain ongoing (this is a developing story. Please check back for more details).
