A compromised credential in the ConnectWise Cloud Backup service has allowed an attacker to log into hundreds of Microsoft 365 tenants using an application identity. Incidents are an important reminder: in a SaaS environment, user accounts are not the only identities that need to be protected, and multi-factor authentication cannot prevent a widely-licensed application from using valid tokens.
What Happened?
ConnectWise said it detected unauthorized access to Cloud Backup-related app identities, formerly known as SkyKick Cloud Backup. Microsoft Threat Intelligence describes it as an active supply chain attack in which a vendor's trusted OAuth application is compromised and used to obtain access tokens in customer tenants.
According to Huntress data compiled by BleepingComputer, unauthorized login activity was present at 173 tenants. This number reflects the abnormally authenticated tenants, which does not mean that the data of all 173 organizations has been stolen. ConnectWise also says there are no indications that the existing backup repository has been compromised.
Key Timeline
- October 13–14, 2026: Huntress linked scripted sign-ins involving the Cloud Backup application to the attacker's IP address.
- 15/10: Microsoft observed widespread successful service principal authentication from IP address 144.172.64[.]128.
- 17/10: ConnectWise cut off Cloud Backup access, disabled seven application identities, and suspended the service for investigation.
- 18/10: The service remained offline; scheduled backups, archive access, and restoration were temporarily unavailable.
What Is a Service Principal?
In Microsoft Entra ID, the service principal is the identity that represents an application inside the tenant. A backup service needs to read emails, OneDrive files, SharePoint, or Teams data, so customers usually grant the app the corresponding Microsoft Graph permissions. The app then authenticates with a secret or certificate instead of a username and password.
This model helps automate machine-to-machine operation, but also creates a large impact radius if the supplier's credentials are exposed. An attacker does not need to take over each account; they can use the permissions that the customer has already granted to the application.
Why Did MFA Not Stop the Attack?
The MFA mainly protects the user login flow. In this case, the authentication requests came from the app identity with valid information, without the user entering a password or receiving a confirmation request. So a rule that focuses only on staff accounts may miss out on service principal activity altogether.
This is also the reason login logs are not interactive and service principal logs need to be monitored as user logs. A successful authentication from an unknown address, user-agent in script form or outside the normal operating pattern must be considered as an investigative signal.
Broad Permissions Turn a Vendor Incident Into a Supply Chain Attack
BleepingComputer cites Todyl's research that the app is capable of reading and writing emails, attachments, OneDrive, SharePoint, and Teams conversations, depending on each tenant granted. Microsoft notes permissions may include Directory.ReadWrite.All. Huntress also observed a number of service principals assigning themselves directory roles, mostly Exchange Administrators.
In a tenant, the retention activity takes about five minutes: a Teams-related app claims Global Administrator rights and adds credentials to other apps. This suggests that disabling the initial application is necessary but not sufficient if the attacker has created an alternative secret, credential, or access path.
Operational Impact and the Limits of Available Evidence
ConnectWise pauses Cloud Backup, SaaS Security, and Cloud Management as a precautionary measure. The direct consequence is that the scheduled backups do not run and the customer cannot restore from the affected warehouse during the downtime. Supplier indicates that existing backup repositories remain encrypted and isolated.
Three concepts need to be separated: successful login, accessibility by permissions granted, and evidence of data actually being read or exported. Microsoft Graph logs are not always detailed enough to prove each object was accessed. Therefore, the organization should investigate under the assumption of caution but avoid asserting data loss in the absence of evidence.
Priority Checklist for Administrators
- Tìm service principal ConnectWise Cloud Backup với App ID
506e08f9-6e9a-4da4-942b-a099a03644aevà các ứng dụng Cloud Management/SkyKick cũ. - Rà soát đăng nhập service principal từ ngày 13/10, đặc biệt IP
144.172.64[.]128và user-agent dạng Python hoặc curl. - Inspect role assignments, OAuth grants, secrets, and certificate changes across all related applications.
- Hunt for unusual Microsoft Graph activity and Exchange, SharePoint, OneDrive, or Teams access outside normal patterns.
- Disable affected connections according to official guidance, revoke tokens, and remove all unauthorized credentials.
- Revalidate backup and restoration capabilities, along with RPO and RTO targets, once service resumes.
Why Revoking User Sessions Is Not Enough
The app token is separate from the user session. Logging out employees or revoking user sessions does not end app-based access. Todyl warns issued tokens may remain valid until they expire or be deactivated in accordance with the appropriate mechanism; credentials implanted in other identities should also be found and deleted separately.
Long-Term Lessons for Workload Identity Governance
The organization should maintain an inventory of the business application, the owner, the rights granted, the last use date, and the business purpose. The app permission should comply with the minimum guidelines, have a review period, and be revoked when the service is no longer in use. Those tenants that still retain permissions for the old app create a residual risk that is hard to see.
Security teams also need to individually alert for non-interactive authentication, apply Conditional Access for workload identities where appropriate, and prioritize certificates or associated identities over long-term shared secrets. The SaaS provider must design the ability to rotate credentials, isolate each customer and emergency recall without depending on the manual operation of hundreds of tenants.
Conclusion
The ConnectWise Cloud Backup case shows that the Microsoft 365 trust boundary extends to every tenant-authorized application. When a central app identity is compromised, the legitimate right can become a cross-customer attack, while the user MFA remains properly designed. Effective defenses require governance of both human and machine identities, and the ability to quickly detect changes in application permissions and credentials.
VNCyberS compiled from ConnectWise, Microsoft Threat Intelligence, Huntress, Todyl, and BleepingComputer
Tiếng Việt
English