SUMMARY

Between at least October 13 and October 16, 2026, an unknown threat actor used a compromised vendor-held credential belonging to the ConnectWise Cloud Backup application (formerly SkyKick) to obtain Microsoft Graph tokens in customer Microsoft Entra ID and Microsoft 365 tenants. The credential resides in the vendor's own tenant and functions across every tenant where the application has been consented. As a result, risk is not limited to the tenants confirmed so far. Related ConnectWise Cloud Management applications were also abused, including self-assignment to Global Administrator and creation of new client secrets on other applications for persistence.

Reports indicate that there were unauthorized sign-ins in at least 162 tenants as of October 16, 2026, 19:00 UTC. Nearly 1,000 tenants experienced sign-in activity from the primary source IP address, with more than 300 successful sign-ins. Microsoft reportedly described the activity as an "active supply chain attack".

No CVE has been assigned. This incident involves credential theft and OAuth service principal abuse rather than a software vulnerability.

Active exploitation has been observed. Organizations with any ConnectWise Cloud Backup, SkyKick, or ConnectWise Cloud Management application consented in their tenant should immediately disable the associated service principals and review for unauthorized credentials and role assignments. A clean log review does not guarantee the tenant was not accessed.

AFFECTED SYSTEMS AND APPLICATIONS

The following Microsoft Entra ID and Microsoft 365 tenants may be affected if these ConnectWise applications are consented:

Additional Information

• ConnectWise vendor owner tenant ID: 3f9cd7a0-127a-4ed4-bf06-2f830d5616b7
• The Cloud Backup application reportedly has broad access to mail, OneDrive, SharePoint, Teams, and directory data, including highly privileged permissions such as Directory.ReadWrite.All.

TECHNICAL DETAILS

Vulnerability Mechanism

• This is not a software vulnerability and therefore has no CVE. The issue stems from compromise of a vendor-controlled application credential.
• The credential is maintained by the vendor and is valid across every customer tenant that has granted consent to the application. An attacker possessing the credential can obtain Microsoft Graph tokens without requiring customer credentials, MFA approval, or customer-side secrets.
• Rotating customer credentials does not fix the issue. The vendor must reset the compromised credential.
• Microsoft Graph directory reads may not generate audit records. Lack of evidence in logs should not be interpreted as proof no access occurred.
• Disabling the application prevents issuance of new tokens, but existing tokens may remain valid for up to 90 minutes. Revoking user sessions does not terminate this form of access.

Observed Exploitation Timeline

All times UTC unless otherwise noted.

1. October 10-14
   • Failed password spraying activity targeted user accounts.
   • Smart lockout protections blocked two accounts.
   • Four law firm tenants were targeted.
   • No successful user sign-ins were observed.
2. October 15 beginning at 01:58
   • ConnectWise Cloud Management service principals assigned themselves directory roles in approximately 50 Huntress-monitored tenants.
   • Most roles granted were Exchange Administrator.
   • Operations used the kiota-dotnet user agent.
3. October 15 from 03:44 to 03:49
   • In one partner tenant, the Cloud Management MS Teams application granted itself Global Administrator.
   • A Python-urllib/3.12 client added client secrets expiring in 2028 to both an MSP management application and the Huntress application.
   • Nine changes were attempted, six succeeded, and three failed.
4. October 15 from 06:13 to 08:34
   • Graph tokens were acquired across multiple tenants in sequential GUID order.
   • The pattern suggests use of an automated script.
   • Last confirmed successful sign-in occurred at 08:44.
5. October 15 from 09:25 to 12:35 and again from 13:54 to 14:20
   • A second wave targeted 16 tenants in policy, national security, trade, and critical minerals sectors.
   • Targeted services included Exchange Online, SharePoint, Teams, Azure Resource Manager, Entra ID, and Office 365 Management APIs.
   • Most attempts failed because the required service principals did not exist in those tenants.
6. October 16-17
   • Huntress confirmed unauthorized sign-ins in 162 tenants.
   • ConnectWise reportedly disabled the affected applications at 5:15 PM ET on October 17.
   • As of 10:30 AM ET that day, Exchange Online, Teams, and SharePoint Cloud Management applications reportedly still appeared active.

KEY POINTS

Impact Scale

• At least 162 tenants with confirmed unauthorized sign-ins, with some reports of up to 173.
• Nearly 1,000 tenants saw sign-in attempts.
• Total affected tenant count may continue to increase.

Persistence Risk

• Malicious client secrets added to other applications remain active even after ConnectWise applications are disabled.
• Attackers have been seen choosing lower-privilege applications as persistence mechanisms in some tenants.

ConnectWise Position

• ConnectWise reported no evidence that Cloud Backup customer backup data was compromised.
• The investigation remains ongoing.
• Organizations should not assume all compromised credentials have already been reset.

Operational Impact

• Disabling the applications halts automated backup operations.
• Existing backups remain available.
• Backup protection gaps may develop during the outage period.

MITIGATION

Immediate Actions

• Disable, but do not delete, the ConnectWise and SkyKick enterprise applications listed above.
• In Entra Admin Center:
  • Enterprise Applications → Select Application → Properties → Enabled for users to sign in = No
• Do not block the application IDs directly; disable the corresponding service principals.
• Do not re-enable affected applications until ConnectWise confirms all credentials have been reset.
• Review Conditional Access policies for exclusions affecting these applications.
• Restrict creation and use of application secrets where possible.
• Limit assignment of Application Administrator and Cloud Application Administrator roles.
• Consider Conditional Access for workload identities and Entra ID Protection controls.
• Establish alternate data protection processes if backups are interrupted.

Patch or Upgrade Status

No customer-side patch or upgrade exists. Remediation depends on ConnectWise resetting the compromised credential.

WHAT THE CYBER FUSION CENTER IS DOING

The CFC is monitoring the situation and analyzing the case to identify potential threat-hunting campaigns. This advisory will be updated if required.

REFERENCES

• https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access
• https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html
• https://daily.dev/posts/connectwise-skykick-vendor-credentials-abused-in-m365-attacks-tq39pgeow