A compromised vendor credential allowed attackers to authenticate through ConnectWise Cloud Backup and reach 173 Microsoft 365 partner and customer tenants, according to investigations by Microsoft Threat Intelligence and Huntress. The campaign is a supply-chain incident: instead of stealing a password from every victim, the operator abused a trusted multitenant backup application that customers had already authorized.

ConnectWise Cloud Backup, previously known as SkyKick Backup, can require broad Microsoft Graph permissions to protect Exchange, OneDrive, SharePoint, Teams and directory data. Those legitimate privileges make the application valuable to customers—and especially dangerous when its own identity is compromised.

App-only authentication bypassed the normal user path

Huntress determined that an API secret belonging to the vendor had been compromised. Authentication records showed a client assertion originating from the vendor’s home tenant, rather than a password entered by a user inside each customer organization. The attacker could therefore request access tokens as the application without satisfying an employee’s usual multifactor authentication prompt.

The activity involved the ConnectWise Cloud Backup application ID 506e08f9-6e9a-4da4-942b-a099a03644ae. On October 15, the application authenticated from 144.172.64[.]128 and obtained Microsoft Graph tokens between 06:13 and 08:34 UTC. Tenant identifiers were attempted in sequence only seconds apart, a pattern consistent with automation operating from a prepared list.

Investigators also observed potentially durable persistence in one Huntress partner tenant. A second application, ConnectWise Cloud Management – MS Teams, assigned itself the Global Administrator role. It then used a Python script to add client secrets—set to expire in 2028—to two other trusted applications. Those additional credentials matter because disabling the initially abused ConnectWise identity would not automatically remove access planted elsewhere.

Why ordinary sign-in reviews may miss the attack

This campaign used service principals rather than human identities. Administrators who examine only the default user sign-in view could incorrectly conclude that nothing happened. Investigation should begin in the Service principal sign-ins area of Microsoft Entra and extend to audit records for role assignments, application changes and newly registered credentials.

• Filter for the Cloud Backup application ID and the reported public source address.
• Correlate Python user agents with app identity, IP address and sensitive Graph actions.
• Review application secrets and certificates added since October 13, including on unrelated trusted apps.
• Look for unapproved directory roles and changes to Conditional Access exclusions.
• Investigate “Add service principal credentials” and “Update application” audit events.

ConnectWise listed Python-urllib/3.12 and python-requests/2.31 among observed user agents, while Microsoft also reported python-requests/2.34.2. These strings are not malicious on their own; administrators and automation commonly use the same libraries. They become meaningful when combined with the known application, infrastructure, timing and privilege changes.

Containment requires more than disabling one app

Impacted organizations should disable—but not delete—the ConnectWise Cloud Backup and ConnectWise Cloud Management – MS Teams service principals while investigating. Deletion can remove consent information and complicate recovery. Disabling may interrupt automated backups, but it does not erase backup data already held by ConnectWise.

Teams should remove unauthorized directory roles, delete unknown client secrets or certificates and keep the applications disabled until ConnectWise confirms that vendor-side credentials have been reset. They should also consider the possibility of data access even when logs show no obvious mailbox or file download. Some Microsoft Graph directory operations provide limited evidence, and absence of a familiar user event is not proof of safety.

ConnectWise said containment measures were in place and that it had no indication partner backup data was accessed at the time of its advisory. The threat actor remains unidentified and the wider investigation continues. For defenders, the central lesson is immediate: trusted application identities deserve the same monitoring, credential hygiene and incident-response attention as privileged human accounts.