Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers’ M365 environments.
ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs) to secure their clients’ Microsoft 365 or Google Workspace data. To accomplish its tasks, the application is granted broad access to mailboxes, OneDrive, SharePoint, Teams, and directory data in every tenant on which it’s installed.
Huntress said it has observed confirmed unauthorized sign-ins within 173 partner/customer tenants using the compromised vendor credential. The incident impacts every organization that has the app installed, and the credential works against every tenant the app is consented in.
“The app’s credential is in hostile hands,” security researcher Jonathan Semon said. “It was used to obtain Microsoft Graph tokens in customer tenants from 144.172.64[.]128 on October 15, between 06:13 and 08:34 UTC. The actor moved through tenants in sorted GUID order, a few seconds apart, which points to a script working from a target list.”
In the observed attackers, the adversary has been observed authenticating to the app using their own tooling, in a manner analogous to the backup service, and obtains tokens with the app’s existing permissions. Given that the app has extensive permissions to access customer data, an attacker in possession of the tokens can read mailboxes, files, and directory data the backup service can.
Huntress said the same IP address engaged in password spraying against four law firm tenants on October 13 and 14, 2026, although it said it detected no successful user sign-ins in its telemetry.
In at least one partner tenant, the cybersecurity company said it found a separate ConnectWise app assigning itself Global Administrator privileges and adding credentials to other trusted applications within this environment, thereby opening a pathway to other privileged apps within customer environments. This effectively extends the risk beyond the vendor account.
“The ConnectWise Cloud Management app for Microsoft Teams (application ID 24205314-2b89-4e07-a2a4-579e898a5640) added itself to the Global Administrator role, then ran a Python script (User-Agent Python-urllib/3.12) that modified two other applications in the tenant: an MSP management application, and Huntress’s own application (Huntress Security Platform), adding new client secrets to both,” Semon explained.
“The two applications that received new secrets are trusted, privileged tools. Adding a credential to an MSP management application can extend access beyond the one tenant, because those applications are often consented into the MSP’s customers’ tenants. A credential on a security tool’s application gives the holder whatever that tool is permitted to do.”
Todyl, in a similar analysis, said it detected an unauthorized party authenticating to Microsoft Graph as the ConnectWise Cloud Backup application.
“The access inherited the app’s existing consent, which permits read/write access to mail and attachments (full mailbox access through Exchange Web Services), OneDrive and SharePoint files, and Teams chats, including the ability to restore data,” Nicholas Koken, Todyl’s head of Detection Engineering, said.
“Revoking user sessions does not end this access. Disabling the app in a tenant stops new tokens from being issued there, though tokens already issued stay valid for up to 90 minutes. Any tenant where the app is still enabled stays exposed until ConnectWise rotates the credential.”
In response to the incident, ConnectWise has taken the step of closing Cloud Backup application access until further notice. The company said it has found no evidence that Cloud Backup partner backup data has been compromised. It has also shared the following indicators of compromise –
- In the Microsoft Entra Admin Center, navigate to Monitoring → Sign-in logs, select the Service principal sign-ins tab, and filter by Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae.
- The default User sign-ins tab will not display the required information.
- In the IP address column, review authentication activity originating from IP addresses outside expected Microsoft/Azure ranges. The application’s normal egress has been identified as Azure private IPv6.
- Suspicious IP address: 144.172.64[.]128
“The backup service needs broad access to do its job, and an attacker using its credentials will inherit that level of access for every tenant where the app is installed,” Huntress explained.
“Depending on the permissions in the tenant, that can include mailboxes, OneDrive and SharePoint files, Teams data, and directory information, much of it belonging to your clients. Some of that access, such as directory reads through Microsoft Graph, leaves no audit trail, which is why we suggest acting now instead of waiting for proof of access. The full potential impact depends on the permissions in play in each tenant.”
Users are recommended to disable the application until ConnectWise confirms all credentials have been reset, enable Microsoft Graph activity logs, audit for any new credentials added since October 13, 2026, and check Entra audit logs for ConnectWise or SkyKick applications adding themselves to a directory role.
The development comes as Google’s Mandiant and Google Threat Intelligence Group, along with ManageEngine Threat Analysis Lab, detailed an “ephemeral supply chain tampering” of the update infrastructure belonging to AOMEI Backupper, a data backup, disk cloning, and disaster recovery software, to bypass traditional security defenses and deliver malware such as CROSSROAD and SHINYROAD.
“The threat actor conducted repeated, short-burst configuration tampering against AOMEI origin servers,” Google said. “Each tampering window remained active for only five to ten minutes before reverting to authentic versions. During the brief tampering windows, the threat actor modified the update settings file on the update server to redirect the software to download a malicious ZIP package from attacker-controlled servers instead of legitimate updates.”
The ZIP archive contains CROSSROAD, an initial downloader responsible for environment validation and staging follow-on payloads. It’s also designed to establish scheduled task-based persistence to deploy SHINYROAD, a modular backdoor framework for covert command-and-control, via DLL sideloading.
The software supply chain compromise campaign, which occurred between April and July 2026, has been attributed to a previously undocumented threat cluster codenamed UNC7017. The activity marks the first time that such a compromise has played out in brief intervals instead of maintaining a persistent, static modification on the servers.
The campaign is assessed to have impacted organizations spanning a wide range of sectors, including IT services, telecommunications, higher education, and related entities in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the U.S.
(This is a developing story. Please check back for more details.)
