Cybersecurity researchers are sounding the alarm regarding an active campaign where unknown threat actors are abusing a compromised **Microsoft 365** (**M365**) credential linked to **ConnectWise Cloud Backup** to gain unauthorized access to customer **M365** environments. **ConnectWise Cloud Backup** is a crucial cloud-based backup and recovery service designed for managed service providers (**MSPs**) to safeguard their clients' **Microsoft 365** or **Google Workspace** data. To function, the application is granted extensive access to mailboxes, **OneDrive**, **SharePoint**, **Teams**, and directory data across every tenant where it is installed. ### Widespread Unauthorized Access **Huntress** reported observing confirmed unauthorized sign-ins within 173 partner/customer tenants using the compromised vendor credential. The incident affects every organization with the app installed, as the credential works against every tenant where the app is consented. Security researcher **Jonathan Semon** of **Huntress** stated, "The app's credential is in hostile hands. It was used to obtain **Microsoft Graph** tokens in customer tenants from 144.172.64[.]128 on October 15, between 06:13 and 08:34 UTC. The actor moved through tenants in sorted GUID order, a few seconds apart, which points to a script working from a target list." In the observed attacks, the adversary authenticated to the app using their own tooling, mirroring the backup service's functionality, and obtained tokens with the app's existing permissions. Given the app's extensive permissions, an attacker with these tokens can read mailboxes, files, and directory data that the backup service would normally access. **Huntress** also noted that the same IP address engaged in password spraying against four law firm tenants on October 13 and 14, 2026, though no successful user sign-ins were detected in their telemetry. ### Expanding the Attack Surface In at least one partner tenant, **Huntress** discovered a separate **ConnectWise** app assigning itself **Global Administrator** privileges and adding credentials to other trusted applications within the environment. This effectively extends the risk beyond the vendor account. "The **ConnectWise Cloud Management** app for **Microsoft Teams** (application ID 24205314-2b89-4e07-a2a4-579e898a5640) added itself to the **Global Administrator** role, then ran a Python script (User-Agent Python-urllib/3.12) that modified two other applications in the tenant: an **MSP** management application, and **Huntress's** own application (**Huntress Security Platform**), adding new client secrets to both," **Semon** explained. "The two applications that received new secrets are trusted, privileged tools. Adding a credential to an **MSP** management application can extend access beyond the one tenant, because those applications are often consented into the **MSP's** customers' tenants. A credential on a security tool's application gives the holder whatever that tool is permitted to do." **Todyl**, in a separate analysis, confirmed detecting an unauthorized party authenticating to **Microsoft Graph** as the **ConnectWise Cloud Backup** application. "The access inherited the app's existing consent, which permits read/write access to mail and attachments (full mailbox access through **Exchange Web Services**), **OneDrive** and **SharePoint** files, and **Teams** chats, including the ability to restore data," stated **Nicholas Koken**, **Todyl's** head of Detection Engineering. "Revoking user sessions does not end this access. Disabling the app in a tenant stops new tokens from being issued there, though tokens already issued stay valid for up to 90 minutes. Any tenant where the app is still enabled stays exposed until **ConnectWise** rotates the credential." ### ConnectWise Response and Mitigation In response to the incident, **ConnectWise** has temporarily closed **Cloud Backup** application access. The company has stated it found no evidence that **Cloud Backup** partner backup data has been compromised. They have also provided the following steps for detecting indicators of compromise: * In the **Microsoft Entra Admin Center**, navigate to Monitoring → Sign-in logs, select the Service principal sign-ins tab, and filter by Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae. * The default User sign-ins tab will not display the required information. * In the IP address column, review authentication activity originating from IP addresses outside expected **Microsoft/Azure** ranges. The application's normal egress has been identified as **Azure** private IPv6. * Suspicious IP address: 144.172.64[.]128 "The backup service needs broad access to do its job, and an attacker using its credentials will inherit that level of access for every tenant where the app is installed," **Huntress** emphasized. "Depending on the permissions in the tenant, that can include mailboxes, **OneDrive** and **SharePoint** files, **Teams** data, and directory information, much of it belonging to your clients. Some of that access, such as directory reads through **Microsoft Graph**, leaves no audit trail, which is why we suggest acting now instead of waiting for proof of access. The full potential impact depends on the permissions in play in each tenant." Users are advised to disable the application until **ConnectWise** confirms all credentials have been reset, enable **Microsoft Graph** activity logs, audit for any new credentials added since October 13, 2026, and check **Entra** audit logs for **ConnectWise** or **SkyKick** applications adding themselves to a directory role. ### Broader Supply Chain Concerns This incident follows recent disclosures by **Google's Mandiant** and **Google Threat Intelligence Group**, alongside **ManageEngine Threat Analysis Lab**, detailing an "ephemeral supply chain tampering" of the update infrastructure for **AOMEI Backupper**. This campaign bypassed traditional security defenses to deliver malware such as **CROSSROAD** and **SHINYROAD**. "The threat actor conducted repeated, short-burst configuration tampering against **AOMEI** origin servers," **Google** stated. "Each tampering window remained active for only five to ten minutes before reverting to authentic versions. During the brief tampering windows, the threat actor modified the update settings file on the update server to redirect the software to download a malicious ZIP package from attacker-controlled servers instead of legitimate updates." The ZIP archive contained **CROSSROAD**, an initial downloader responsible for environment validation and staging follow-on payloads. It was also designed to establish scheduled task-based persistence to deploy **SHINYROAD**, a modular backdoor framework for covert command-and-control via **DLL** sideloading. This software supply chain compromise, occurring between April and July 2026, has been attributed to a previously undocumented threat cluster codenamed **UNC7017**. This marks the first time such a compromise has played out in brief intervals rather than maintaining persistent, static modifications on servers. The campaign is believed to have impacted organizations across various sectors, including IT services, telecommunications, and higher education, in countries like Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the U.S. ### Microsoft's Confirmation **Microsoft** has also confirmed tracking an "active supply chain attack in which a threat actor compromised the trusted **OAuth App** of the backup application **ConnectWise Cloud Backup** (AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae), formerly **SkyKick Backup**, to obtain access tokens across customer tenants." The tech giant stated the threat actor likely abused permissions previously granted by customers to the application, including highly privileged permissions like Directory.ReadWrite.All. "On October 15, 2026, we observed broad successful service principal authentication originating from the IP address 144.172.64[.]128," **Microsoft** added. "Follow-on activity included **Microsoft Graph API** reconnaissance and attempts to add additional credentials on the related service principal in target tenants to maintain direct access as a backdoor." **Microsoft** recommends that security teams review service principal sign-ins from unrecognized IP addresses, app credential changes, and **OAuth** grant activity associated with the aforementioned **OAuth AppId**. **ConnectWise**, in a separate advisory, confirmed identifying unauthorized access to application identities within the **ConnectWise Cloud Backup** environment and has temporarily shut off **Cloud Backup** application access.