Ongoing Microsoft 365 Campaign Abuses ConnectWise App

The severe supply-chain compromise involving ConnectWise Cloud Backup, formerly known as SkyKick, is currently enabling unauthorized entry into Microsoft 365 environments, prompting the vendor to suspend critical services while security teams scramble to audit their tenants. 

Threat actors have compromised a credential within the vendor’s infrastructure, allowing them to abuse a client assertion that bypasses traditional user authentication mechanisms. Because the application was granted high-level permissions to perform its backup duties, the actors inherit those broad privileges, enabling them to navigate mailboxes, SharePoint, Teams, and directory data across client tenants without triggering MFA prompts.

Threat intelligence teams and security researchers have been working on the issue over the weekend as the attacks have spread and become more serious. Researchers from Huntress have been tracking the campaign and have seen the attackers–who are coming from one specific IP address–targeting organizations in several high-value industries. 

“During further investigations, Huntress identified a second, targeted wave of attempts from 144.172.64[.]128 on October 15, unsuccessfully targeting a narrow scope of 16 Huntress-protected tenants. These tenants are in the policy, national security, trade, and critical mineral sectors. Unlike the first wave of activity…most of these tenants do not rely on any ConnectWise products. In tenants without the relevant ConnectWise service principal, the attempts failed because the application was not present,” Jonathan Semon of Huntress said.

The campaign has escalated beyond simple data exfiltration, with attackers actively weaponizing the foothold to establish persistence and elevate privileges. In confirmed instances, the threat actors have utilized the ConnectWise Cloud Management application for Microsoft Teams to self-assign the Global Administrator role. Once elevated, the attackers inject unauthorized credentials into other applications within the target tenant, creating secrets with expiration dates as far out as 2028. 

This ensures that even if the primary compromised vendor credential is eventually rotated or disabled, the actors retain persistent backdoors. While initial activity was traced to a specific hosting provider IP, subsequent waves of the campaign have demonstrated increased sophistication..

ConnectWise has suspended the affected services, including Cloud Backup, SaaS Security, and Cloud Management. The company has explicitly revoked the certificates used for the affected application connections and invalidated the shared credentials previously associated with Cloud Backup. Although existing backup archives remain encrypted and isolated, they are currently inaccessible while the investigation continues. 

“We are still in the investigation stage of our incident response process, validating critical findings and mitigation paths. We do not have a restoration time to share yet. We will advise partners when we exit this phase and provide reconnection or reauthorization instructions as soon as they are confirmed,” ConnectWise said in its advisory.

ConnectWise said that this service interruption is a proactive containment measure and does not imply that partner or customer backup data has been accessed. The vendor has engaged a third-party incident response firm to assist in monitoring their infrastructure and validating mitigation paths, though a full restoration timeline has not yet been established.

Microsoft Threat Intelligence researchers have been tracking the campaign, too.

“We assess that the threat actor likely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory.ReadWrite.All,” MSTIC said.

“On October 15, 2026, we observed broad successful service principal authentication originating from the IP address 144.172.64[.]128. Follow-on activity included Microsoft Graph API reconnaissance and attempts to add additional credentials on the related service principal in target tenants to maintain direct access as a backdoor.”

Defenders should treat this incident with immediate urgency by conducting a thorough audit of their Microsoft Entra logs. Administrators need to navigate to the Monitoring section in the Microsoft Entra Admin Center, access the Service principal sign-ins tab, and filter specifically by the application ID 506e08f9-6e9a-4da4-942b-a099a03644ae to identify potential malicious activity. 

It’s critical to review authentication traffic originating from IP addresses outside of standard Microsoft or Azure ranges, specifically flagging the suspicious IP 144.172.64[dot]128. If malicious signs are detected, administrators should disable the affected application IDs rather than deleting them, as deletion can disrupt service recovery by breaking consent. Also, teams should audit any credentials added to management or security tools since October 13 and remove any that cannot be verified as legitimate. Until ConnectWise provides further instructions for restoration, organizations should assume these service principals remain a vector for continued unauthorized access.