“Huntress confirmed ... at least 162 compromised tenants” — a single sentence that, by Friday, changed the conversation for managed service providers and Microsoft 365 administrators tied to ConnectWise’s Cloud Backup service.
Scope and initial indicators: 162 tenants and a single IP
Reports of unauthorized access to Microsoft 365 tenants tied to ConnectWise’s Cloud Backup (formerly SkyKick Cloud Backup) began surfacing on Friday. Managed cybersecurity platform Huntress said it had identified at least 162 compromised tenants. Microsoft likewise confirmed malicious activity, saying it observed unauthorized authentication attempts from the IP address 144.172.64[.]128 on October 15.
Investigators traced scripted sign‑in attempts to the same IP address across multiple telemetry sources. Huntress linked the attacker IP to scripted sign‑in attempts on October 13 and 14 using the user agent curl/7.88.1; other observed user agents tied to the malicious activity include python-urllib/3.12, python-requests/2.31, and python-requests/2.34.2.
How the service principal was abused
ConnectWise’s Cloud Backup relies on Microsoft Entra ID service principals—application identities that act on behalf of the backup software inside a customer tenant. According to Todyl researchers, the attacker authenticated directly to Microsoft 365 as the backup application using its secret, effectively using the permissions customers had already granted the app.
Todyl described the sign‑in pattern as automated and noted that, because these were application authentications rather than user logins, protections such as multi‑factor authentication did not block them. “Because the application already held broad, previously granted permissions in each tenant, those sign‑ins gave the attacker the technical ability to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats,” Todyl said.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildReconnaissance and persistence activity observed by vendors
While Todyl’s analysis of nine tenants found only sign‑in activity without evidence that the actor created accounts or changed passwords, Huntress and Microsoft observed more aggressive operations in other environments. Huntress reported nearly 50 tenants where ConnectWise Cloud Management service principals assigned themselves directory roles—mostly Exchange Administrator—including one instance where a service principal granted itself Global Administrator and added credentials to an MSP management tool and to Huntress’s own application.
Microsoft also observed persistence activity after successful service principal authentication, including a backdoor, Microsoft Graph API reconnaissance, and attempts to add additional credentials. Microsoft Threat Intelligence characterized the incident as an active supply‑chain attack and assessed the attacker likely abused existing permissions, including Directory.ReadWrite.All.
Indicators, application IDs, and tactical checks for administrators
Huntress identified the legitimate Cloud Backup application ID used in the attacks as 506e08f9-6e9a-4da4-942b-a099a03644ae and published an extended list of related ConnectWise Cloud Management application IDs for tenant checks. Administrators are being urged to review service principal sign‑ins in Entra, filter by those application IDs, and examine unexpected source addresses and credential changes.
- ConnectWise Cloud Backup: 506e08f9-6e9a-4da4-942b-a099a03644ae
- ConnectWise Cloud Management: 2399d300-6fca-4e6a-a686-399fefe75b83
- Cloud Management - MS Teams: 24205314-2b89-4e07-a2a4-579e898a5640
- Cloud Management - Exchange Online: b78f6a77-d4e5-46fb-87e5-d1648bd02519
- Cloud Management - MS Graph: 0de14c77-b9b0-4137-9360-34878a929827
- Cloud Management - Partner Center: 412dcf96-176d-4b3a-a1b0-4981ad66971e
- Cloud Management - SharePoint Online: b2b55f5b-7758-4719-8d8f-88ae172e6bdb
ConnectWise recommended administrators check service principal sign‑ins in Entra and said it had shut down application access for partners and clients after “recently identified unauthorized access to application identities within the ConnectWise Cloud Backup environment.” The vendor added: “We have no indicators to date that Cloud Backup partner backup data has been compromised. The existing cloud backup archive is not impacted by this service interruption and will be accessible once services are restored.”
Advice and practical constraints: what disabling the service does — and does not — accomplish
Huntress advised disabling the implicated ConnectWise applications and reviewing application credentials for unauthorized additions. Todyl warned that disabling an application prevents new tokens from being issued but does not invalidate existing tokens until they expire, and that revoking user sessions does not end application‑based access. Huntress therefore urged admins to review secrets and certificates across all applications for unauthorized additions dating back to October 13.
ConnectWise announced the backup service interruption at 05:01 UTC on October 17 but provided no timeline for restoring the connection. At the time of publishing, the full victim count and the extent of any data theft remained unclear, and the method used to obtain vendor credentials was not reported.
There is an operational lesson embedded in the record: once an attacker is operating under valid credentials, traditional prevention measures materially weaken—the Blue Report 2026, cited in the reporting, notes that prevention drops sharply after initial access and measures defenses across 338 million simulations. For now, customers and MSPs face a narrow set of hard tasks: search for the listed application IDs, audit recent credential changes, remove unauthorized secrets, and watch the single IP and user‑agent indicators tied to this active supply‑chain incident.
