ConnectWise SkyKick Supply Chain Credential Abuse

An unknown actor used a compromised credential for the ConnectWise Cloud Backup application (formerly SkyKick Backup) to sign in to customer Microsoft 365 tenants as the application itself. The application is a legitimate multi-tenant app that managed service providers deploy to back up Microsoft 365 data. Every tenant that consented to it granted broad permissions. One credential held by the vendor therefore worked against every consenting tenant. The sign-ins are app-only and involve no user, device or MFA prompt. Todyl notes that controls aimed at users, such as MFA and Conditional Access for users, did not apply.

The 15 October sign-ins came from the hosting provider IP address 144.172.64[.]128 and moved through tenants in sorted GUID order. That pattern points to a script working from a target list. Microsoft Threat Intelligence confirmed broad successful service principal authentication from that address. Huntress confirmed unauthorized sign-ins in 162 tenants as of 19:00 UTC on 16 October 2026. The Hacker News later reported 173, citing Huntress. On 17 October Huntress said almost 1,000 Entra tenants showed sign-in activity from the address. Over 300 of those succeeded.

Microsoft also reported Graph API reconnaissance and attempts to add additional credentials on the related service principal in target tenants. Separately, in one tenant Huntress saw the ConnectWise Cloud Management - MS Teams app add itself to Global Administrator and then add client secrets to two other applications. Huntress has not tied that activity to the IP address activity. It says the access behind it came from private Azure IPv6 space.

ConnectWise disabled seven application identities at 07:00 UTC on 17 October and revoked the certificates behind the Cloud Backup connections. It states the shared Cloud Backup credentials are no longer valid. ConnectWise reports no indicators that backup archives were compromised. It also says it cannot determine from its own investigation whether a particular customer environment was affected. Todyl recommends treating affected tenant data as exposed. The sources report no confirmed data theft. Visibility into app-only reads is limited. Disable the Cloud Backup and Cloud Management - MS Teams applications in each tenant without deleting them. Huntress also advises considering the other Cloud Management applications. Then review application credentials added since 13 October.

Hunting fingerprints: source IP 144.172.64[.]128 (AS14956). Cloud Backup application ID 506e08f9-6e9a-4da4-942b-a099a03644ae. Cloud Management - MS Teams application ID 24205314-2b89-4e07-a2a4-579e898a5640. Other Cloud Management application IDs: 2399d300-6fca-4e6a-a686-399fefe75b83 (Cloud Management), b78f6a77-d4e5-46fb-87e5-d1648bd02519 (Exchange Online), 0de14c77-b9b0-4137-9360-34878a929827 (MS Graph), 412dcf96-176d-4b3a-a1b0-4981ad66971e (Partner Center) and b2b55f5b-7758-4719-8d8f-88ae172e6bdb (SharePoint Online). Vendor tenant ID 3f9cd7a0-127a-4ed4-bf06-2f830d5616b7. User agents Python-urllib/3.12, python-requests/2.31, python-requests/2.34.2 and curl/7.88.1 are low fidelity on their own. The legitimate app normally signs in from Azure private IPv6 space.