ConnectWise Disables Seven App Identities After Compromised Credential Hit 173 Microsoft 365 Tenants

Managed service providers have always been a leveraged target: one vendor identity can unlock hundreds of downstream customer environments at once. On October 17, 2026, that risk became concrete across the ConnectWise partner ecosystem, when unknown threat actors used a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup, the product formerly known as SkyKick, to sign into 173 partner and customer tenants.

ConnectWise Cloud Backup is a cloud based backup and recovery service built for MSPs to protect clients' Microsoft 365 or Google Workspace data. The application is granted broad access to mailboxes, OneDrive, SharePoint, Teams, and directory data in every tenant where it is installed. That breadth is exactly what makes the service useful, and it is also what made its credential so valuable to an intruder. As Huntress put it, the credential works against every tenant the app is consented in, and the incident impacts every organization that has the app installed.

The activity did not start on October 17. The Hacker News reported on October 17 that unknown threat actors abused a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup, formerly SkyKick, to gain unauthorized access to customers' Microsoft 365 environments. Reports of malicious activity began emerging on Friday, and based on reports from Microsoft, Huntress, and administrators, the malicious activity started at least on October 15 from a single IP address, 144.172.64[.]128. ConnectWise identified the issue on October 14, 2026 through monitoring, which prompted internal and external incident response.

What followed was a rapid, multi vendor account of a supply chain attack. According to Todyl researchers, the attacker authenticated directly to Microsoft 365 as the backup application using its secret, gaining the permissions customers had already granted it. The credential type was a client assertion, meaning the credential lives in the vendor's own tenant, so nothing a customer did could have produced it. Legitimate ConnectWise traffic, by contrast, comes from Azure private IP space.

Key Facts

Huntress reported on October 16 that it had confirmed unauthorized sign-ins within 173 partner and customer tenants using the compromised vendor credential, a figure that stood at 162 tenants as of 19:00 UTC that day before rising to the final count. The same research found almost 1,000 Entra tenants with sign-in activity from 144.172.64[.]128, out of which more than 300 succeeded; in some tenants the absence of a service principal prevented access.

The unauthorized sign-ins ran on October 15, 2026 between 06:13 and 08:34 UTC. Huntress researcher Jonathan Semon said the app's credential is in hostile hands, and that it was used to obtain Microsoft Graph tokens in customer tenants from 144.172.64[.]128. In his description, the actor moved through tenants in sorted GUID order, a few seconds apart, which points to a script working from a target list.

ConnectWise said on Saturday that it disabled seven ConnectWise application identities as it continued investigating unauthorized access to the application identities and the compromised Microsoft 365 tenants. The disabled identities were ConnectWise Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae), ConnectWise Cloud Management (2399d300-6fca-4e6a-a686-399fefe75b83), Cloud Management - MS Teams (24205314-2b89-4e07-a2a4-579e898a5640), Exchange Online (b78f6a77-d4e5-46fb-87e5-d1648bd02519), MS Graph (0de14c77-b9b0-4137-9360-34878a929827), Partner Center (412dcf96-176d-4b3a-a1b0-4981ad66971e) and SharePoint Online (b2b55f5b-7758-4719-8d8f-88ae172e6bdb).

The Hacker News reported on October 18 that ConnectWise took the action on October 17, 2026 at 07:00 UTC and suspended Cloud Backup by revoking the certificates used for affected application connections across all users. The company said disabling connections prevents new authentication but does not reverse changes already made in a tenant, and that previously issued access tokens may remain usable until they expire. Scheduled backups are not running, and access to affected backup archives and restoration remains unavailable, although existing archives remain encrypted, isolated and preserved, with no evidence of breach.

Todyl noted that the inherited consent permits read and write access to mail and attachments, including full mailbox access through Exchange Web Services, along with OneDrive and SharePoint files and Teams chats, including the ability to restore data. Revoking user sessions does not end this access, and tokens already issued stay valid for up to 90 minutes. In at least one partner tenant, a separate ConnectWise app, the ConnectWise Cloud Management app for Microsoft Teams (application ID 24205314-2b89-4e07-a2a4-579e898a5640), added itself to the Global Administrator role and then ran a Python script with the user agent Python-urllib/3.12 that added new client secrets to two other applications: an MSP management application and Huntress's own Security Platform application.

Analysis

What this really means is that the trust model underpinning MSP tooling has been inverted. A backup application that exists to restore customer data became, for a window measured in days, a ready made intrusion path into 173 tenants. Because the credential was a client assertion living in the vendor's own tenant, there was no customer misconfiguration to blame and no customer side control that would have stopped the sign-in. The detection that mattered was not a policy setting but an anomaly: sign-ins from a hosting provider address rather than Azure private IP space, arriving in GUID order a few seconds apart.

The automation and the follow-on activity suggest an operator who understood the platform's permission model. Huntress reported that the same IP engaged in password spraying against four law firm tenants on October 13 and 14, 2026, with no successful user sign-ins detected, and it said a second, targeted wave of attempts from 144.172.64[.]128 on October 15 singled out a narrow scope of 16 tenants in the policy, national security, trade, and critical mineral sectors and was unsuccessful. That second wave first swept SkyKick Graph tokens between 09:25:04 and 12:35:50 UTC and then ran a manual second sweep between 13:54:39 and 14:20:24 UTC targeting Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and the Office 365 Management APIs.

The bigger picture here is that vendor applications are now the load bearing wall of Microsoft 365 security for small and mid sized organizations, and the wall was penetrated without a single customer credential being phished. Huntress itself was a downstream victim: on October 16 the firm identified and removed an unauthorized credential on its own application in one tenant, after the Cloud Management app for Microsoft Teams had added credentials to a single tenant Huntress application. Trust in a vendor, Todyl's analysis implies, is functionally identical to granting that vendor's application persistent delegated authority, and revoking sessions inside the customer tenant does not claw it back.

ConnectWise's own framing is important to read carefully. It said it found no evidence that Cloud Backup partner backup data was compromised, and it said the existing cloud backup archive is not impacted by the service interruption and will be accessible once services are restored. That is a statement about data at rest, not about the tenant access the credential conferred. Meanwhile the practical remediation path laid out by Huntress, disabling rather than deleting the Cloud Backup app and the Cloud Management app for Microsoft Teams, reviewing credentials on all Microsoft 365 applications, auditing for new credentials added since October 13, 2026, enabling Microsoft Graph activity logs, and not re-enabling anything until ConnectWise confirms all credentials have been reset, is unusually blunt for vendor incident response.

Why It Matters

The headline number, 173 tenant sign-ins, understates the exposure. Huntress identified almost 1,000 Entra tenants with sign-in activity from the same IP address, and more than 300 of those attempts succeeded. Any organization that had consented the application in its tenant was in scope, and the failure mode in the remaining tenants was the absence of a service principal, not a defensive control the customer had chosen.

BleepingComputer reported on October 17 that ConnectWise shut down customer access to its Cloud Backup service after hackers accessed application identities and compromised Microsoft 365 tenants. The interruption is not cosmetic. Scheduled backups are not running for affected partners, and restoration access is unavailable, which means the recovery capability itself is offline during the exact period when organizations are most likely to need it.

Microsoft confirmed malicious activity involving ConnectWise's Cloud Backup service, saying it identified unauthorized authentication attempts from an IP address on October 15. That confirmation, combined with Huntress's tenant counts and Todyl's permission analysis, turns a contested incident into a documented supply chain event, and it puts every MSP platform vendor's application identity inventory under scrutiny.

Next Up

Attention now shifts to whether the seven disabled application identities can be safely re enabled. Huntress's guidance is explicit: do not re enable until ConnectWise confirms all credentials have been reset, and treat the period before the October 17 shutdown as a window that must be audited for newly added credentials, new client secrets, and unexpected role assignments. Administrators who received a Microsoft Privileged Identity Management notification on October 15, as one Reddit user described after a SkyKick service principal assigned itself the Exchange Administrator role, should treat that as a lead rather than a curiosity.

The larger open question is architectural. So long as backup and management applications hold standing client assertion credentials in a vendor tenant and are granted broad consent across customer environments, the same attack shape remains available. The Hacker News reported on October 17 that the incident impacts every organization that has the app installed, which is a description of a class of risk, not a single breach.