# Compromised ConnectWise Cloud Backup (SkyKick) OAuth App Credential Used to Sign In to 173 Microsoft 365 Tenants

> A compromised vendor credential for the ConnectWise Cloud Backup (formerly SkyKick Backup) Microsoft 365 application was used to authenticate as a service principal into 173 partner and customer tenants on 2026-10-15. Related ConnectWise Cloud Management apps assigned themselves directory roles and added client secrets to other trusted applications, creating persistence pathways.

- **Published:** 2026-10-17T11:38:40Z
- **Last reviewed:** 2026-10-17T11:38:40Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3798
- **ID:** TL-2026-3798
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-15 between 06:13 and 08:34 UTC, an actor used a compromised credential belonging to the ConnectWise Cloud Backup (formerly SkyKick) multi-tenant Microsoft Entra application (app ID 506e08f9-6e9a-4da4-942b-a099a03644ae) to obtain Microsoft Graph tokens in customer tenants from 144.172.64.128 (RouterHosting, AS14956). Huntress reports the credential type was a client assertion, meaning the credential lives in the vendor's own tenant and nothing a customer did could have exposed it. The actor walked tenants in sorted GUID order, seconds apart, consistent with a script working from a target list. Huntress confirmed 162 unauthorized sign-ins by 2026-10-16; reporting by The Hacker News and others puts the total at 173 tenants.

The Cloud Backup app is normally granted broad delegated-service permissions to perform backup and recovery: Exchange mailboxes, OneDrive, SharePoint, Teams data and directory information, with read/write capability. Huntress and Todyl note the permissions available to the attacker include mailbox read/write, file operations, user password resets, Conditional Access policy modification and directory role assignment. Some access, such as Graph directory reads, leaves no audit trail, so absence of evidence is not evidence of absence.

The campaign was preceded by password spraying of four law-firm tenants on 2026-10-13/14 from the same IP using the curl/7.88.1 user agent. Separately, on 2026-10-15 at about 01:58 UTC, ConnectWise Cloud Management service principals were assigned directory roles in roughly 50 Huntress-monitored tenants. At 03:44-03:49 UTC, the Cloud Management MS Teams app (24205314-2b89-4e07-a2a4-579e898a5640) added itself to the Global Administrator role and then, via a Python script (Python-urllib/3.12 / python-requests), modified two other trusted applications, adding client secrets set to expire in 2028. One of these was an MSP management application and the other the Huntress Security Platform application. An attempt to add a certificate failed (thumbprint mismatch) before the client secret additions succeeded.

Affected organizations span IT services, telecommunications, higher education and law firms across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Turkiye and the United States. ConnectWise shut down Cloud Backup application access until further notice and states it has no indication that partner backup data was compromised; the incident concerned the authentication credentials used by the backup application, not backup archives. No threat actor has been named. Microsoft Threat Intelligence confirmed it is tracking the incident. No CVE is assigned; this is a vendor credential compromise and OAuth application abuse supply-chain event.

## MITRE ATT&CK

- T1110.003 Password Spraying
- T1199 Trusted Relationship
- T1078.004 Cloud Accounts
- T1550.001 Application Access Token
- T1098.001 Additional Cloud Credentials
- T1098.003 Additional Cloud Roles
- T1098.003 Additional Cloud Roles
- T1059.006 Python
- T1087.004 Cloud Account
- T1526 Cloud Service Discovery

## Sources

- [Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants](https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html)
- [ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks - Huntress](https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access)
- [Investigation: Unauthorized Access Through the ConnectWise Cloud Backup Microsoft 365 App - Todyl](https://www.todyl.com/blog/investigation-unauthorized-access-through-the-connectwise-cloud-backup-microsoft-365-app)
- [ConnectWise Trust Center Advisories - Cloud Backup / SkyKick unauthorized access](https://www.connectwise.com/company/trust/advisories)
- [ConnectWise Status Page](https://status.connectwise.com/)
- [Microsoft Security Intelligence post on the ConnectWise incident](https://x.com/MsftSecIntel/status/2111358888125878426)
- [Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 accounts - Cybersecurity News](https://cybersecuritynews.com/connectwise-credentials-microsoft-365-accounts/)
- [r/msp thread: CW SkyKick breach](https://www.reddit.com/r/msp/comments/1x7gw61/cwskykick_breach/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3798