Emerging ThreatsData Breaches

Hackers Exploit Compromised Credential to Breach 173 Microsoft 365 Tenants

Analyst 207||Source: TheHackerNews
A workstation with a laptop on a desk and network equipment in the background.
"The app's credential is in hostile hands," security researcher Jonathan Semon said.

Unknown threat actors have abused a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to sign in to 173 partner and customer tenants, cybersecurity firm Huntress reported. The credential — a single application identity used by the backup service to access tenant data — was used to obtain Microsoft Graph tokens on October 15, between 06:13 and 08:34 UTC from IP 144.172.64[.]128, according to Huntress telemetry.

Scope: 173 tenants, broad data access

ConnectWise Cloud Backup is a cloud-based backup and recovery service that, by design, is granted broad permissions across mailboxes, OneDrive, SharePoint, Teams, and directory data in every tenant where it is installed. Huntress confirmed unauthorized sign-ins within 173 partner/customer tenants using the compromised vendor credential and warned the incident affects every organization that has the app installed because the credential works against every tenant the app is consented into.

How the actors obtained and used Microsoft Graph tokens

Huntress observed the adversary authenticating to Microsoft Graph as the ConnectWise application from the single IP address and noted the actor moved through tenants in sorted GUID order a few seconds apart — behavior consistent with scripted access to a prepared target list. In the observed pattern, the attacker obtained tokens with the app's existing permissions and thereby could read mailboxes, files, Teams chats, and directory data that the backup service can access.

Todyl corroborated that an unauthorized party authenticated as the ConnectWise Cloud Backup application and that "the access inherited the app's existing consent, which permits read/write access to mail and attachments (full mailbox access through Exchange Web Services), OneDrive and SharePoint files, and Teams chats, including the ability to restore data," Nicholas Koken, Todyl's head of Detection Engineering, said.

Privilege escalation inside at least one tenant

Huntress found at least one partner tenant where a separate ConnectWise application — the ConnectWise Cloud Management app for Microsoft Teams (application ID 24205314-2b89-4e07-a2a4-579e898a5640) — added itself to the Global Administrator role. That app then ran a Python script (User-Agent Python-urllib/3.12) that modified two other applications in the tenant by adding new client secrets: an MSP management application and Huntress's own application (Huntress Security Platform).

Huntress warned that adding credentials to trusted, privileged applications can extend access beyond a single tenant because MSP management applications are often consented into MSP customers' tenants, and credentials on security tools grant whatever permissions those tools already hold.

Detection and immediate mitigations recommended

ConnectWise has closed Cloud Backup application access until further notice and stated it has found no evidence that partner backup data has been compromised. The company and responders provided concrete steps for tenant administrators:

  • In the Microsoft Entra Admin Center, navigate to Monitoring → Sign-in logs, select the Service principal sign-ins tab, and filter by Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae.
  • Do not rely on the default User sign-ins tab; it will not display the required information.
  • In the IP address column, review authentication activity originating from IP addresses outside expected Microsoft/Azure ranges; the application's normal egress has been identified as Azure private IPv6.
  • Watch for the suspicious IP address 144.172.64[.]128.
  • Disable the application in a tenant to stop new tokens from being issued; be aware already-issued tokens remain valid for up to 90 minutes. Tenants must wait until ConnectWise rotates the compromised credential to restore safe, continued use.
  • Enable Microsoft Graph activity logs, audit for any new credentials added since October 13, 2026, and check Entra audit logs for ConnectWise or SkyKick applications adding themselves to directory roles.

Related supply-chain activity: AOMEI Backupper tampering attributed to UNC7017

The development coincides with a separate advisory from Google, Mandiant, and ManageEngine describing an "ephemeral supply chain tampering" campaign against AOMEI Backupper between April and July 2026. That campaign redirected update downloads to attacker-controlled servers for brief five-to-ten-minute windows and delivered payloads including CROSSROAD (an initial downloader) and SHINYROAD (a modular backdoor). The activity was attributed to a previously undocumented cluster codenamed UNC7017 and impacted organizations across multiple countries and sectors, per the advisory.

For tenants and MSPs whose environments rely on ConnectWise Cloud Backup, the immediate reality is stark: an application designed for convenience and broad data access becomes a universal key when its credential is compromised. Administrators must follow the sign-in log guidance, disable the app where appropriate, and look for newly added credentials and role changes since October 13, 2026. ConnectWise's closure of Cloud Backup access is a necessary containment step; the next critical action is a confirmed rotation of the compromised credential so protected tenants can safely re-enable the service.

Read the original advisory: https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html

Cloud SecurityConnectwiseEmerging ThreatsHuntressSupply ChainMfa BypassCloud BackupCredential AbuseMicrosoft 365 BreachTenant Breach
Related Intelligence

Continue Reading

Federal bankruptcy court building entrance with somber atmosphere and people in background.

BAE Systems Breach Disrupts US Bankruptcy Court Notices

A cybersecurity incident at BAE Systems has brought the US bankruptcy court notice system to a grinding halt, with the company's Bankruptcy Noticing Center (BNC) websites taken offline and notice production suspended nationwide. The disruption affects every federal bankruptcy court in the United States.

Analyst 207
Blurred server rack in a brightly-lit tech facility.

Chinese hackers exploit BeyondTrust zero-day in espionage push

Chinese hackers have been exploiting a critical zero-day vulnerability in BeyondTrust Remote Support, first detected on August 29, in a sophisticated espionage campaign attributed to the threat group Armory Castle. A patch was released on October 8 to fix the defect, tracked as CVE-2026-102764.

Analyst 207
Network router on a rack with multiple cables and surrounding equipment in a dimly lit server room.

Unit 42 Threat Intel Exposes Top Vectors for Initial Access Attacks

Cyber attackers are exploiting weaknesses in public-facing systems and using stolen credentials to gain a foothold, with a growing reliance on external edge exploitation and identity compromise. This alarming trend highlights the need for robust defenses to protect against initial access attacks.

Analyst 207
Server room with rows of computer servers and networking equipment, one rack with highlighted ports centered.

Attackers Hijack AOMEI Backupper's Update Servers to Deploy Backdoor

In a shocking security breach, attackers hijacked AOMEI Backupper's update servers for just a few minutes on three separate occasions, deploying a sneaky backdoor to unsuspecting users who checked for updates during that time. This tiny window of opportunity was all the hackers needed to compromise the system, thanks to a vulnerability in AOMEI's update process.

Analyst 207