A cyberattack involving ConnectWise Cloud Backup has allowed attackers to exploit trusted application credentials and gain unauthorized access to Microsoft 365 environments belonging to hundreds of organizations.
Security researchers at Huntress identified suspicious authentication activity across nearly 1,000 Microsoft Entra tenants, including more than 300 successful sign-ins. Earlier findings identified unauthorized access affecting at least 162 Microsoft 365 tenants.
The incident prompted ConnectWise to suspend its Cloud Backup service, formerly known as SkyKick Cloud Backup, while investigators worked to contain the compromise.
Researchers also uncovered evidence that attackers manipulated trusted cloud applications to obtain administrative privileges and establish persistent access within at least one customer environment.
The full number of affected organizations and the extent of any data theft remain under investigation.
Compromised application credentials bypassed user authentication
The attack involved unauthorized use of application credentials associated with ConnectWise Cloud Backup, a service that managed service providers use to protect customer Microsoft 365 data.
Cloud backup platforms typically require extensive permissions to access Exchange Online mailboxes, SharePoint documents, OneDrive files and other business information.
According to Huntress researchers investigating the incident, attackers exploited the trust granted to ConnectWise applications to authenticate directly into customer environments.
Unlike conventional account compromises, this activity did not require attackers to steal individual employee passwords or complete the normal interactive login process.
Instead, the attackers reportedly used vendor-controlled application credentials to obtain Microsoft Graph access tokens with permissions previously granted to the backup service.
Because application authentication operates differently from user authentication, multifactor authentication requirements applied to employee accounts would not necessarily prevent this type of access.
Huntress identified suspicious authentication activity beginning October 15, 2026, with malicious sign-ins originating from infrastructure inconsistent with the application’s expected behavior.
Investigation expands beyond initial 162 tenants
Initial findings published October 16 identified unauthorized access affecting at least 162 Microsoft 365 tenants.
However, Huntress subsequently expanded its findings, reporting suspicious authentication attempts across nearly 1,000 Microsoft Entra tenants and more than 300 successful authentications.
These figures reflect observed authentication activity and should not be interpreted as confirmation that every targeted organization suffered data theft.
The investigation also identified unsuccessful authentication attempts against organizations outside the known ConnectWise Cloud Backup customer population.
Some of those attempts reportedly targeted organizations operating in sensitive sectors, including national security, foreign policy and critical minerals.
The unsuccessful attempts suggest the attackers were testing whether the compromised application identities could provide access to additional environments.
No established threat actor group has been publicly identified as responsible for the attack.
Attackers planted credentials in other trusted applications
One of the most concerning findings involves activity extending beyond the original compromised backup application.
Huntress researchers observed attackers abusing additional ConnectWise Cloud Management applications associated with Microsoft Teams, Exchange Online and SharePoint Online.
In at least one customer environment, a ConnectWise Cloud Management application reportedly assigned itself the Global Administrator role, providing extensive control over the affected Microsoft Entra tenant.
The attackers then modified other trusted applications by adding unauthorized authentication credentials.
Huntress identified this activity affecting 2 applications, including one associated with its own security platform.
Researchers confirmed that an unauthorized credential added to the Huntress application was subsequently used for 7 sign-ins before being discovered and removed.
This behavior creates a significant persistence risk because attackers may retain access through newly added credentials even after the original compromised application is disabled.
The technique aligns with MITRE ATT&CK T1098.001, which describes persistence through additional cloud application credentials.
Investigators have not established whether similar persistence mechanisms were deployed across other affected tenants.
ConnectWise suspends Cloud Backup operations
ConnectWise acknowledged the security incident and confirmed unauthorized access involving application identities associated with its Cloud Backup service.
The company subsequently suspended access to the affected service and revoked certificates associated with compromised application connections.
The shutdown interrupted backup and restoration operations for organizations relying on ConnectWise Cloud Backup.
According to the company’s official security advisories, investigators have not identified evidence that customer backup archives stored within its infrastructure were compromised.
ConnectWise has also indicated that existing backup data remains intact.
However, the absence of identified backup archive compromise does not rule out unauthorized access to information within customer Microsoft 365 environments.
Those environments were accessed through trusted application identities, making the potential exposure separate from the security of stored backup archives.
The company continues investigating the incident and working toward restoring affected services.
Microsoft 365 administrators face additional investigation requirements
Organizations using ConnectWise Cloud Backup or related Cloud Management applications should review their Microsoft Entra environments for suspicious authentication activity and unauthorized changes to application permissions.
Security researchers recommend several immediate actions:
- Review application sign-ins: Examine Microsoft Entra service principal authentication logs for suspicious activity beginning October 15.
- Inspect privileged applications: Identify unexpected Global Administrator assignments and changes to application permissions.
- Audit application credentials: Look for unfamiliar client secrets or certificates added to trusted applications.
- Investigate persistence: Review audit logs for unauthorized modifications to service principals and application registrations.
- Remove malicious credentials: Revoke unauthorized authentication material and investigate any subsequent use.
- Follow vendor guidance: Keep affected integrations disabled until ConnectWise confirms that the relevant credentials have been secured.
Huntress recommends disabling affected applications rather than immediately deleting them, allowing organizations to preserve configuration information and restore legitimate integrations after remediation.
Administrators should also investigate applications that were modified during the incident, since removing the original compromised credential may not eliminate access established through other application identities.
Supply-chain access puts downstream customers at risk
The ConnectWise incident highlights the security risks created when third-party technology providers receive privileged access to customer cloud environments.
Managed service providers and cloud management platforms often require broad permissions to perform backups, administer services and support customer operations.
When attackers compromise credentials associated with those platforms, they may gain access to multiple organizations without breaching each customer individually.
BreachNews previously covered the Klue supply-chain breach involving Salesforce customer data theft, another incident illustrating how compromised third-party access can expose downstream organizations.
Similar concerns have emerged around managed service providers themselves. In a separate case, BreachNews reported on an alleged breach involving managed service provider Xtium, where a threat actor claimed access to a substantial volume of infrastructure and customer-related data.
Neither incident has been linked to the ConnectWise attack.
The latest compromise is particularly significant because investigators observed attackers attempting to extend their access by modifying other trusted cloud applications.
That activity means organizations cannot rely solely on the suspension of ConnectWise Cloud Backup to determine whether their Microsoft 365 environments are secure.
While the total number of compromised organizations remains uncertain, the observed unauthorized authentications, privilege escalation and application credential manipulation demonstrate the potential impact of a single compromised cloud service identity.
ConnectWise and security researchers continue investigating the incident as affected organizations assess whether attackers accessed business information or established additional routes into their Microsoft 365 environments.
