ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks

A critical security breach involving ConnectWise Cloud Backup (formerly SkyKick) has allowed an unauthorized actor to access customer Microsoft 365 tenants. By compromising a credential within the vendor's own environment, the attacker obtained Microsoft Graph access tokens, enabling them to read mailboxes, files, and directory data. The activity is characterized by scripted movements through tenants in sorted GUID order and an apparent preference for victims whose names begin with the letter "A."
While the primary impact involves data access, evidence from at least one tenant shows a sophisticated escalation path. In this instance, the attacker elevated the service principal to Global Administrator and established persistence by adding unauthorized client secrets to other privileged management and security tools. There is significant uncertainty regarding the total volume of data exfiltrated, as directory reads through Microsoft Graph do not leave a standard audit trail. Organizations are advised to disable affected ConnectWise applications and audit all enterprise application credentials for unauthorized additions since October 13.

• ConnectWise Cloud Backup (formerly SkyKick) is a cloud-based backup and recovery service for Microsoft 365 and Google Workspace.
• Unauthorized sign-ins to customer Microsoft 365 tenants occurred on October 15, 2026, between 06:13 and 08:34 UTC.
• Sign-ins originated from IP address 144.172.64[.]128.
• Huntress confirmed unauthorized sign-ins in 162 tenants.
• Attackers used a client assertion credential located in the vendor's own tenant.
• On October 15, between 03:44 and 03:49 UTC, an attacker used the ConnectWise Cloud Management - MS Teams app to grant itself the Global Administrator role in one customer tenant.
• In that same tenant, the attacker added new client secrets to an MSP management application and the Huntress Security Platform application.
• Password spraying against four law firm tenants from 144.172.64[.]128 occurred between October 13 and 14.
• ConnectWise acknowledged the incident and confirmed the associated IP address.
• Affected applications include ConnectWise Cloud Backup, Cloud Management, and specific modules for MS Teams, Exchange Online, and SharePoint Online.

The strongest version of this narrative is a transparent, technical disclosure of a supply-chain compromise designed to trigger immediate remediation. It provides specific IOCs and actionable steps to neutralize a live threat, prioritizing community protection over corporate image.
However, this is a vendor-authored threat intelligence report. The narrative utilizes a specific framing: it positions the author's own platform as both a victim (through the addition of unauthorized secrets) and a primary detector/defender. This creates a loop where the evidence of the breach is inextricably linked to the utility of the author's security services. By highlighting the "invisible" nature of Graph directory reads, the narrative emphasizes a gap in native Microsoft logging that only a third-party security partner can effectively help navigate.
Patterns detected: ARC-0031 Authority Game, ARC-0011 Fear Appeal
The root cause is the inherent risk of "broad consent" in MSP models. The paradigm assumes that granting a vendor wide-ranging permissions is a necessary trade-off for automation, creating a single point of failure that can cascade across hundreds of downstream clients.
This incident highlights a diminishing sense of agency for the end-user; when a vendor's internal credential is stolen, no amount of local MFA or password hygiene can prevent the breach. The cost is borne by the clients, while the benefit of the "broad access" is enjoyed by the vendor for operational ease.
Bridge Questions:
1. If native logs cannot track directory reads, what architectural changes are required to make cloud-to-cloud permissions truly auditable?
2. Does the "broad consent" model for MSPs fundamentally break the principle of least privilege beyond repair?
Counterstrike Scan: A coordinated campaign would use this event to sow distrust in all cloud-backup vendors to drive migrations to a specific "secure" alternative. The actual content is a targeted technical alert and does not match this pattern.