Threat reportSupply ChainTL-2026-3798
Compromised ConnectWise Cloud Backup (SkyKick) OAuth App Credential Used to Sign In to 173 Microsoft 365 Tenants
Compromised ConnectWise Cloud Backup (SkyKick) OAuth App (TL-2026-3798), also tracked as ConnectWise Cloud Backup vendor credential compromise, is a critical-severity supply-chain compromise, first published 2026-10-17. It has no confirmed attribution, affects ConnectWise Cloud Backup (formerly SkyKick Backup) Microsoft 365, maps to 9 MITRE ATT&CK techniques (T1059.006, T1078.004, T1087.004), and is covered by 9 detection rules and 14 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 0None referenced
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-3798
- Threat ID
- TL-2026-3798
- Also known as
- ConnectWise Cloud Backup vendor credential compromise, SkyKick credential abuse
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- managed service providers, legal, telecoms, higher education, it services
- Target regions
- australia, brazil, india, pakistan, portugal, singapore, south africa, spain, switzerland, Turkiye, united states of america
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in Compromised ConnectWise Cloud Backup (SkyKick) OAuth App
Malware and tooling: ConnectWise - S0591, Python-urllib/3.12, curl/7.88.1, python-requests/2.31, python-requests/2.34.2
How Compromised ConnectWise Cloud Backup (SkyKick) OAuth App works
A compromised vendor credential for the ConnectWise Cloud Backup (formerly SkyKick Backup) Microsoft 365 application was used to authenticate as a service principal into 173 partner and customer tenants on 2026-10-15. Related ConnectWise Cloud Management apps assigned themselves directory roles and added client secrets to other trusted applications, creating persistence pathways.
On 2026-10-15 between 06:13 and 08:34 UTC, an actor used a compromised credential belonging to the ConnectWise Cloud Backup (formerly SkyKick) multi-tenant Microsoft Entra application (app ID 506e08f9-6e9a-4da4-942b-a099a03644ae) to obtain Microsoft Graph tokens in customer tenants from 144.172.64.128 (RouterHosting, AS14956). Huntress reports the credential type was a client assertion, meaning the credential lives in the vendor's own tenant and nothing a customer did could have exposed it. The actor walked tenants in sorted GUID order, seconds apart, consistent with a script working from a target list. Huntress confirmed 162 unauthorized sign-ins by 2026-10-16; reporting by The Hacker News and others puts the total at 173 tenants.
The Cloud Backup app is normally granted broad delegated-service permissions to perform backup and recovery: Exchange mailboxes, OneDrive, SharePoint, Teams data and directory information, with read/write capability. Huntress and Todyl note the permissions available to the attacker include mailbox read/write, file operations, user password resets, Conditional Access policy modification and directory role assignment. Some access, such as Graph directory reads, leaves no audit trail, so absence of evidence is not evidence of absence.
The campaign was preceded by password spraying of four law-firm tenants on 2026-10-13/14 from the same IP using the curl/7.88.1 user agent. Separately, on 2026-10-15 at about 01:58 UTC, ConnectWise Cloud Management service principals were assigned directory roles in roughly 50 Huntress-monitored tenants. At 03:44-03:49 UTC, the Cloud Management MS Teams app (24205314-2b89-4e07-a2a4-579e898a5640) added itself to the Global Administrator role and then, via a Python script (Python-urllib/3.12 / python-requests), modified two other trusted applications, adding client secrets set to expire in 2028. One of these was an MSP management application and the other the Huntress Security Platform application. An attempt to add a certificate failed (thumbprint mismatch) before the client secret additions succeeded.
Affected organizations span IT services, telecommunications, higher education and law firms across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Turkiye and the United States. ConnectWise shut down Cloud Backup application access until further notice and states it has no indication that partner backup data was compromised; the incident concerned the authentication credentials used by the backup application, not backup archives. No threat actor has been named. Microsoft Threat Intelligence confirmed it is tracking the incident. No CVE is assigned; this is a vendor credential compromise and OAuth application abuse supply-chain event.
MITRE ATT&CK techniques used in TL-2026-3798
Execution
Initial Access
T1078.004 Cloud Accounts; T1199 Trusted Relationship
Discovery
T1087.004 Cloud Account; T1526 Cloud Service Discovery
Persistence
T1098.001 Additional Cloud Credentials; T1098.003 Additional Cloud Roles
Privilege Escalation
T1098.003 Additional Cloud Roles
Credential Access
lateral-movement
Affected products and versions in Compromised ConnectWise Cloud Backup (SkyKick) OAuth App
- ConnectWise — Cloud Backup (formerly SkyKick Backup) Microsoft 365 application
Vulnerable versions: All tenants with app 506e08f9-6e9a-4da4-942b-a099a03644ae consented - ConnectWise — Cloud Management (MS Teams, Exchange, Graph, Partner Center, SharePoint) applications
Vulnerable versions: Tenants with Cloud Management service principals installed - Microsoft — Microsoft 365 / Entra ID tenants with the affected applications
Vulnerable versions: Customer and partner tenants where the apps were consented
Remediation for Compromised ConnectWise Cloud Backup (SkyKick) OAuth App
Immediate actions
- Disable (do not delete) the ConnectWise Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae) and Cloud Management enterprise applications in Entra admin center until ConnectWise confirms credential rotation; note service principal tokens may remain valid ~90 minutes after disablement
- Review Entra service principal sign-in logs for the app from 144.172.64.128 or any non-Azure IP range
- Audit new credentials (client secrets/certificates) added to enterprise applications and app registrations since 2026-10-13, especially MSP management and security tools such as the Huntress application
- Check Entra audit logs for ConnectWise/SkyKick service principals assigned to directory roles (Global Administrator, Exchange Administrator) and remove unintended roles
- Review Conditional Access exclusions for these applications and revoke user sessions
- Report suspicious activity to SecurityPartnerSupport@ConnectWise.com
Workarounds
- Treat directory-read access as possible even without audit evidence and act without waiting for proof of access
- Wait for ConnectWise status page confirmation before re-enabling Cloud Backup
Longer-term hardening
- Enable Microsoft Graph activity logs to capture future directory reads
- Apply application management policies restricting client secrets
- Limit Application Administrator and Cloud Application Administrator role assignments
- Deploy Conditional Access for workload identities and enable Entra ID Protection risky service principal detection
- Alert on service principals modifying other applications or adding service principal credentials
Timeline of Compromised ConnectWise Cloud Backup (SkyKick) OAuth App
- Password spraying of four law-firm tenants begins from 144.172.64.128 using the curl/7.88.1 user agent (continues into 2026-10-14).
- 06:13-08:34 UTC: the compromised Cloud Backup credential obtains Microsoft Graph tokens in customer tenants from 144.172.64.128, walking tenants in sorted GUID order seconds apart.
- 03:44-03:49 UTC: the Cloud Management MS Teams app adds itself to Global Administrator, then a Python script (Python-urllib/3.12) adds client secrets expiring in 2028 to two other trusted applications, including an MSP management app and the Huntress Security Platform app; a certificate addition fails first.
- At about 01:58 UTC, ConnectWise Cloud Management service principals are assigned directory roles in roughly 50 Huntress-monitored tenants.
- ConnectWise shuts down Cloud Backup application access until further notice and publishes an advisory stating it has no indicators that partner backup data was compromised.
- Huntress publishes analysis confirming 162 unauthorized sign-ins and that the credential is a vendor-side client assertion; Todyl publishes its investigation.
- The Hacker News and other outlets report the scope as 173 Microsoft 365 tenants; Microsoft Threat Intelligence confirms it is tracking the incident.
Sources cited for Compromised ConnectWise Cloud Backup (SkyKick) OAuth App
- Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
- ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks - Huntress
- Investigation: Unauthorized Access Through the ConnectWise Cloud Backup Microsoft 365 App - Todyl
- ConnectWise Trust Center Advisories - Cloud Backup / SkyKick unauthorized access
- ConnectWise Status Page
- Microsoft Security Intelligence post on the ConnectWise incident
- Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 accounts - Cybersecurity News
- r/msp thread: CW SkyKick breach
Detection coverage for TL-2026-3798
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3798 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.