In several confirmed instances, the attackers escalated their privileges to Global Administrator roles, allowing them to plant secondary credentials for long-term persistence. This specific supply-chain breach, which came to light on October 15, 2026, targeted the ConnectWise Cloud Backup environment, previously known as SkyKick. By gaining unauthorized access to application identities, the threat actors managed to compromise at least 162 Microsoft 365 tenants, leveraging stolen application credentials to authenticate as a trusted service principal within customer environments. This method allowed the intruders to inherit all permissions previously granted to the application, providing them with virtually unfettered access to sensitive emails, organizational files, and private directory data. Currently, the ConnectWise Cloud Backup service remains suspended as forensic experts and federal investigators work to determine the full extent of the intrusion. While there is no immediate evidence that backup archives were exfiltrated, the situation remains fluid and high-risk for all managed service providers.
1. Technical Foundations: The Supply-Chain Breach
The core of the vulnerability lies in the exploitation of a compromised client secret associated with the ConnectWise Cloud Backup application. Unlike traditional phishing attacks that target individual user credentials, this supply-chain compromise focused on the application level, allowing attackers to bypass multi-factor authentication entirely. Once the attackers possessed the valid application credential, they were able to authenticate directly as the service principal. This gave them the ability to exercise all the high-level permissions that had been granted to the backup service during its initial setup, most notably the Directory.ReadWrite.All permission. With such authority, the malicious actors were capable of reading and modifying data across Microsoft Teams, SharePoint, and Exchange Online. The breach highlights a significant weakness in how organizations manage third-party service permissions, as the automated nature of these backups often requires broad access that becomes a primary target for sophisticated adversaries.
Beyond the initial entry, investigators observed highly sophisticated tactics designed to maintain long-term control over the compromised Microsoft 365 environments. The attackers utilized automated scripts, specifically python-urllib and python-requests, to navigate through various tenants with speed and precision from the source IP address 144.172.64.128. By performing reconnaissance through the Microsoft Graph API, they mapped out directory structures and identified high-value targets within each organization. To ensure they could not be easily evicted, the intruders frequently assigned themselves elevated administrative roles, such as Exchange Administrator and Global Administrator. In several recorded cases, the threat actors added new client secrets to other legitimate, trusted applications already present in the customer’s cloud environment. This strategic move created a persistent backdoor, allowing the attackers to retain access even if the primary compromised ConnectWise credentials were changed.
2. Software Impact: Tracking the Incident Timeline
The scope of the incident extends across several critical applications within the ConnectWise and former SkyKick ecosystem, affecting tools that are central to cloud management and data protection. Among the primary targets were the ConnectWise Cloud Backup application and its specialized integrations for Microsoft Teams, Exchange Online, and SharePoint Online. Additionally, the breach impacted the ConnectWise Cloud Management suite, which many managed service providers use to oversee Partner Center operations and overall tenant health. The specific application IDs identified as compromised include the main backup service and the Microsoft Graph integration, which serves as the bridge for data movement between the backup platform and the Microsoft cloud. Because these tools are often deployed with global permissions to ensure seamless data protection, the compromise of a single set of application secrets had a cascading effect. Organizations that utilize these management tools face a daunting task of verifying the integrity of every service principal.
The timeline of the breach reveals a rapid progression from initial reconnaissance to full-scale unauthorized access across the customer base. Detailed forensic logs indicate that scripted sign-in attempts began as early as October 13 and 14, originating from the known malicious IP infrastructure. By October 15, the attackers had successfully leveraged the stolen credentials to gain unauthorized entry into over 160 customer tenants. ConnectWise first identified the suspicious activity on October 14 and immediately launched an internal incident response protocol to contain the damage. On October 17, as the scale of the supply-chain attack became clearer, the company took the decisive step of deactivating the affected application identities and suspending the Cloud Backup service entirely. As of October 18, the service remains offline while ongoing investigations continue to analyze the telemetry data. This timeline underscores the necessity for real-time monitoring of service principal activity, as the window from the first probe to the suspension lasted only a few days.
3. Recommended Actions: Essential Mitigation Steps
Organizations must take immediate and decisive action to secure their Microsoft Entra environments by disabling all high-risk applications associated with this breach. The most critical step involves locating the ConnectWise Cloud Backup application, specifically identified by application ID 506e08f9-6e9a-4da4-942b-a099a03644ae, and disabling its ability to authenticate within the tenant. This action should be extended to all related management IDs for Teams, SharePoint, and Exchange Online that were part of the vulnerable supply chain. Administrators should keep these applications in a disabled state until the vendor provides formal confirmation that all credentials have been securely reset and new, safe identities have been established. It is important to remember that simply disabling the service on the vendor’s side does not automatically remove the risk from the local tenant; manual intervention in the admin center is required to ensure no further tokens are issued. This proactive isolation is the only way to guarantee that the attacker cannot continue to use the service principal.
A comprehensive audit of all application credentials and secrets is the next essential phase of the remediation process for any affected Microsoft 365 tenant. Security teams need to meticulously search for any unauthorized client secrets, certificates, or keys that were added to their environments starting from October 13. This includes checking not only the primary ConnectWise apps but also any other third-party applications that may have been tampered with to establish persistence. Simultaneously, administrators should examine the sign-in logs for any activity originating from the IP address 144.172.64.128 or involving user agents such as curl and specific Python libraries. Furthermore, it is vital to inspect mailbox configurations for unauthorized changes, such as new inbox forwarding rules or transport rules that could be used for data exfiltration. All identified malicious credentials must be deleted immediately, and any suspicious administrative role assignments should be revoked to restore the environment to a known secure state.
4. Security Outlook: Indicators of Compromise and Insights
To aid in the identification of compromised accounts, several key indicators of compromise have been released to the cybersecurity community. The primary network indicator is the IP address 144.172.64.128, which has been linked to the automated scripts used during the breach. Security operations centers should also monitor for specific user-agent strings including python-urllib/3.12, python-requests/2.31, and curl/7.88.1, as these were the tools favored by the threat actors for interacting with the Microsoft Graph API. The breach specifically utilized several application IDs, with the core backup identity being the most prevalent in the forensic data. By cross-referencing these indicators with internal audit logs, organizations can determine if they were among the 162 confirmed victims or if they narrowingly avoided the intrusion. Visibility into service principal activity has historically been a blind spot for many IT departments, but this incident proves that monitoring application-to-application traffic is just as critical as monitoring human user logins.
The remediation of the ConnectWise breach provided a stark lesson in the complexities of managing modern supply-chain risks within cloud ecosystems. Moving forward, organizations began implementing more rigorous controls over the permissions granted to third-party applications, shifting toward a model of least privilege that restricted directory-wide access. Security administrators adopted advanced monitoring tools that flagged anomalous service principal behavior, such as logins from unexpected IP addresses or rapid changes to administrative roles. This proactive approach ensured that future integrations were vetted not just for functionality, but for the resilience of their authentication mechanisms. Many companies also established regular auditing cycles for application secrets, treating them with the same level of scrutiny as high-level user passwords. By prioritizing the visibility of automated service identities, the industry moved to close the gap that allowed this breach to occur. These combined strategies transformed the way businesses secured their cloud environments.
