Science & Tech · Cybersecurity · 10 hrs ago
Hackers Use ConnectWise Cloud Backup Access to Breach Microsoft 365 Tenants
Hackers used a ConnectWise Cloud Backup credential to access Microsoft 365 tenants on October 15.
The activity involved ConnectWise, which provides backup services to businesses and IT providers, and customers whose Microsoft 365 accounts had the app installed.
To back up data, the app had already been granted permissions to access mail, files and other information in those accounts.
The stolen credential let attackers use those existing permissions without signing in as a person, so multi-factor authentication did not stop the access.
Huntress reported confirmed unauthorized sign-ins in 173 partner and customer tenants, while other reporting gave a lower earlier count.
Researchers found attempts to grant apps administrator access and add credentials, though the extent of data access is not clear.
ConnectWise has suspended application access and is investigating; it says it has found no evidence that backup archives were compromised and says they will be available once service is restored.
Hackers used a compromised ConnectWise Cloud Backup credential to access Microsoft 365 tenants where the application was installed.
Huntress reported unauthorized sign-ins in 173 partner and customer tenants.
The activity involved authentication from IP address 144.172.64[.]128 on October 15.
The application’s existing permissions could allow access to email, files, Teams chats and directory data.
ConnectWise shut down Cloud Backup application access and said it had found no evidence that partner backup data was compromised.
- Who
- Unknown threat actors used a compromised credential belonging to ConnectWise Cloud Backup.
- What
- They accessed Microsoft 365 tenants through the backup application’s existing permissions.
- When
- The reported activity included sign-ins on October 15, 2026. Huntress also reported password-spraying attempts on October 13 and 14.
- Where
- Microsoft 365 tenants where ConnectWise Cloud Backup was installed.
- Why
- The sources say the attackers exploited the application’s credential and permissions; their motive is not stated.
This story does not have two clearly opposing sides.
Huntress said the same IP address attempted password spraying against four law firm tenants.
Unauthorized authentication attempts from 144.172.64[.]128 were observed, including sign-ins to Microsoft 365 tenants.
Reports of malicious activity began emerging, according to BleepingComputer.
ConnectWise had shut down Cloud Backup application access, and Microsoft confirmed malicious activity involving the service.
- Affected tenants
- Huntress reported unauthorized sign-ins in 173 partner and customer tenants.
- Source IP
- 144.172.64[.]128
- Sign-in date
- October 15, 2026
- Affected service
- ConnectWise Cloud Backup, formerly SkyKick Cloud Backup
- Application ID
- 24205314-2b89-4e07-a2a4-579e898a5640
- Access status
- ConnectWise shut down application access until further notice
4 sources
Stolen ConnectWise 'SkyKick' credential exposed Microsoft 365 tenants
ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
What people are saying
The app's credential is in hostile hands
We have no indicators to date that Cloud Backup partner backup data has been compromised.
Revoking user sessions does not end this access.
Posts on X
Microsoft Threat Intelligence is tracking an active supply chain attack in which a threat actor compromised the trusted OAuth App of the backup application ConnectWise Cloud Backup (AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae), formerly SkyKick Backup, to obtain access tokens