● Covered by 5 sources · 8 reportsMedium impact6 negative2 neutral
ConnectWise Credential Compromised, Granting Access to 173 Microsoft 365 Tenants
Key points
- ConnectWise Cloud Backup credential compromised.
- 173 Microsoft 365 tenants observed with unauthorized sign-ins.
- Attackers gained access to mailboxes, OneDrive, SharePoint, Teams data.
- A separate ConnectWise app assigned itself Global Administrator privileges.
- ConnectWise Cloud Backup was formerly SkyKick Cloud Backup.
- Malicious activity reports began emerging on Friday.
- Huntress identified at least 162 compromised tenants in its environment.
- Microsoft confirmed malicious activity from an IP address on October 15.
- ConnectWise Cloud Backup provides backup for Google Workspace.
- ConnectWise disabled seven application identities.
- ConnectWise suspended its Cloud Backup service.
- ConnectWise took action on October 17, 2026, at 07:00 UTC.
- ConnectWise revoked certificates for affected application connections.
- ConnectWise also suspended SaaS Security and Cloud Management services.
- ConnectWise suspended services to implement mitigations.
- ConnectWise has not provided an estimated restoration timeline.
- ConnectWise shared information on the IP addresses used in the intrusion.
- ConnectWise published guidance on the intrusion.
- ConnectWise initially said on Friday it was investigating unauthorized access attempts.
- ConnectWise confirmed unauthorized access on Saturday.
- ConnectWise began rolling out mitigations on October 17 at 5:00 a.m. UTC.
- ConnectWise enlisted independent third-party specialists for incident response.
- ConnectWise has not seen successful threat activity in environments it monitors.
- Chinese state-aligned hackers breached ConnectWise's cloud backup service.
- Hackers spied on approximately 2,250 organizations.
- Hackers logged into Microsoft-hosted environments at 3,000 sign-in attempts per minute.
- Hackers used AI agents, specifically ARTEX, for rapid sign-in attempts.
Compromised Credential Leads to Widespread Access
Cybersecurity researchers have identified an active campaign where threat actors are exploiting a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup. This credential has been used to gain unauthorized access to customers' M365 environments.
ConnectWise Cloud Backup, a service for managed service providers (MSPs) to secure client data, requires broad access to mailboxes, OneDrive, SharePoint, Teams, and directory data in every tenant where it is installed. The compromised credential allows attackers to leverage these extensive permissions.
Observed Unauthorized Activity
Huntress, a cybersecurity firm, confirmed unauthorized sign-ins within 173 partner/customer tenants using the compromised vendor credential. The credential is effective against every tenant where the application is consented.
Security researcher Jonathan Semon stated that the app's credential was used to obtain Microsoft Graph tokens in customer tenants from a specific IP address on October 15, between 06:13 and 08:34 UTC. The actor moved through tenants in sorted GUID order, suggesting an automated script.
Scope of Data Exposure
Attackers are authenticating to the app using their own tools, similar to the backup service, to obtain tokens with the app's existing permissions. With these tokens, an attacker can read mailboxes, files, and directory data, mirroring the access capabilities of the backup service itself.
The same IP address was also involved in password spraying attempts against four law firm tenants on October 13 and 14, 2026, though no successful user sign-ins were detected in that specific activity.
Extended Risk Beyond Vendor Account
In at least one partner tenant, Huntress discovered a separate ConnectWise app assigning itself Global Administrator privileges. This app then added credentials to other trusted applications within the environment, creating a pathway to other privileged applications within customer environments. This action extends the potential risk beyond the initial vendor account compromise.
Specifically, the ConnectWise Cloud Management app for Microsoft Teams (application ID 24205314-2b89-4e07-a2a4-579e898a5640) added itself to the Global Administrator role and subsequently modified two other applications in the tenant using a Python script.
Updates
- Chinese state-aligned hackers breached ConnectWise's cloud backup service.
- Hackers spied on approximately 2,250 organizations.
- Hackers logged into Microsoft-hosted environments at 3,000 sign-in attempts per minute.
- Hackers used AI agents, specifically ARTEX, for rapid sign-in attempts.
- ConnectWise began rolling out mitigations on October 17 at 5:00 a.m. UTC.
- ConnectWise enlisted independent third-party specialists for incident response.
- ConnectWise has not seen successful threat activity in environments it monitors.
- ConnectWise also suspended SaaS Security and Cloud Management services.
- ConnectWise suspended services to implement mitigations.
- ConnectWise has not provided an estimated restoration timeline.
- ConnectWise shared information on the IP addresses used in the intrusion.
- ConnectWise published guidance on the intrusion.
- ConnectWise initially said on Friday it was investigating unauthorized access attempts.
- ConnectWise confirmed unauthorized access on Saturday.
- ConnectWise disabled seven application identities.
- ConnectWise suspended its Cloud Backup service.
- ConnectWise took action on October 17, 2026, at 07:00 UTC.
- ConnectWise revoked certificates for affected application connections.
- ConnectWise Cloud Backup was formerly SkyKick Cloud Backup.
- Malicious activity reports began emerging on Friday.
- Huntress identified at least 162 compromised tenants in its environment.
- Microsoft confirmed malicious activity from an IP address on October 15.
- ConnectWise Cloud Backup provides backup for Google Workspace.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub MariaDB/server GitHub zhangutah/security-research GitHub CollaboraOnline/online GitHub advisories/GHSA-qhr7-h655-pw6r GitHub langflow-ai/langflow GitHub wolfSSL/wolfsshHow outlets covered it
Chinese state-aligned hackers breached ConnectWise's cloud backup service, stealing application credentials to access customer data. This allowed them to spy on approximately 2,250 organizations by logging into their Microsoft-hosted environments at a rate of nearly 3,000 sign-in attempts per minute using AI agents.
ConnectWise implemented remediation measures, including credential resets and enhanced administrative protections, following unauthorized access to application identities associated with its Cloud Backup service. The incident led to the suspension of Cloud Backup, SaaS Security, and Cloud Management, impacting partners and customers who need to investigate their own Microsoft 365 tenants for potential unauthorized activity.
ConnectWise suspended its Cloud Backup service and other platforms following a supply chain attack where credentials for its cloud backup system were compromised. This incident allowed unauthorized access to customers' Microsoft 365 environments, prompting ConnectWise to revoke certificates and invalidate shared credentials.
ConnectWise suspended its Cloud Backup service and disabled application identities due to unauthorized access to Microsoft 365 tenants. A China-nexus group exploited a zero-day vulnerability in BeyondTrust Remote Support, affecting a small number of organizations. Microsoft disrupted three phishing kits responsible for over one billion scam messages.
ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services after a compromised credential allowed unauthorized access to customer Microsoft 365 tenants. The incident impacts scheduled backups, security monitoring, and cloud management functions, with no estimated restoration timeline provided.
ConnectWise disabled seven application identities and suspended its Cloud Backup service after attackers gained unauthorized access to application identities and compromised Microsoft 365 tenants. The action prevents new authentication through affected connections, but previously issued access tokens may still be usable.
ConnectWise shut down its Cloud Backup service after hackers accessed application identities, compromising Microsoft 365 tenants. This supply-chain attack allowed unauthorized access to client data within Microsoft 365 environments, impacting numerous organizations.
A compromised credential for ConnectWise Cloud Backup (formerly SkyKick) has been used by unknown threat actors to access 173 Microsoft 365 customer tenants. This incident allows attackers to obtain Microsoft Graph tokens and access sensitive data due to the application's broad permissions.