ConnectWise supply chain attack compromises Microsoft 365 clients

Software company ConnectWise shut down access to its ConnectWise Cloud Backup tool at 05:01 UTC on October 17, 2026, after detecting intrusions into corporate Microsoft 365 environments. Unidentified cybercriminals obtained the credentials for the provider's application identity, formerly known as SkyKick, and used them to access internal data of client companies without needing to interact with user accounts.

Cybersecurity firm Huntress confirmed intrusions in at least 173 organizations linked to its monitoring services. For its part, Microsoft's threat intelligence division classified the incident as an active supply chain attack and indicated that unauthorized authentications began to be detected en masse on October 15, 2026, from IP address 144.172.64[.]128.

ConnectWise stated in a security advisory that, as of the time of disconnection, it has no evidence indicating the theft or alteration of already stored backup files. The company is keeping an internal investigation open while applying mitigation measures to isolate the affected systems.

Authentication mechanism and multi-factor control evasion

The backup service relies on service entities in Microsoft Entra ID, which are identities assigned to software to execute automated tasks in the cloud. According to analyses published by Todyl, the attackers used the application's legitimate cryptographic secret to request access tokens for the Microsoft Graph interface, the communication point between Microsoft 365 services. As this is a direct connection between applications, traditional controls such as multi-factor authentication were immediately bypassed.

The backup tool has high-level authorizations in each corporate environment to back up mailboxes, OneDrive files, SharePoint libraries, and Microsoft Teams chats. Todyl explained that possession of these credentials gave the attackers the technical capability to read and modify sensitive client information in all tenants where the application was authorized.

Huntress verified that the accesses on October 15, 2026, occurred between 06:13 and 08:34 UTC via an automated script that traversed each client's unique identifiers in sequential order with a few seconds of difference. The same IP address had executed brute-force password attack attempts against four law firms between October 13 and 14, 2026, using user agents linked to Python libraries and curl.

Privilege escalation and persistence in affected environments

Although Todyl documented that in nine of the analyzed clients the attackers only performed reads and did not modify permissions, Huntress observed more aggressive behavior in other networks. In nearly fifty monitored environments, management applications associated with ConnectWise assigned administrative directory roles to their identities, primarily that of Exchange administrator.

In at least one affected company, the attackers managed to establish persistence mechanisms in an operation that lasted five minutes. During that interval, the ConnectWise application linked to Microsoft Teams self-assigned global administrator privileges and injected new access keys into two other trusted tools: a management platform for managed service providers and the Huntress Security Platform console itself.

Microsoft confirmed that it detected reconnaissance activities through the Microsoft Graph API and maneuvers to add secondary credentials as backdoors. The technology multinational noted that the attackers abused previous high-impact permissions, such as the authorization to read and modify directories comprehensively.

Containment measures required for administrators

Todyl warned that disabling the application within the administrative portal stops the issuance of new access identifiers, but does not invalidate those already issued, which remain valid for up to ninety minutes. Likewise, revoking active human user sessions has no effect on connections established via application identities.

Huntress and Microsoft recommended that technical teams review service entity access logs in Microsoft Entra ID by filtering for application identifier 506e08f9-6e9a-4da4-942b-a099a03644ae. Administrators must search for connections originating from IP addresses outside the usual private Azure network and verify if unauthorized secrets or certificates have been added to any application since October 13, 2026.

The immediate priority for security teams is to locate clandestinely added credentials in non-ConnectWise administration applications, as disconnecting the provider's service does not remove the persistent access configured in the compromised environments.