Back to threat alerts

Supply Chain Compromise: ConnectWise (SkyKick) Multi-Tenant Credential Compromise Enables Unauthorised Microsoft 365 Access

A critical supply chain cyberattack has compromised multi-tenant Microsoft 365 application credentials belonging to ConnectWise Cloud Backup (formerly SkyKick). Threat actors obtained API secrets and client credentials associated with multi-tenant enterprise applications, enabling them to bypass interactive authentication controls and gain direct administrative access to downstream customer environments.

Threat alert
October 19, 2026

In response, ConnectWise temporarily suspended its Cloud Backup, SaaS Security, and Cloud Management services, disabling seven specific application identities and revoking connection certificates. However, because OAuth access tokens issued prior to the suspension remain valid until they naturally expire, and because secondary backdoor credentials planted by the attacker operate independently of vendor infrastructure, immediate tenant-side hunting and remediation are mandatory.

‍

Date & Time (UTC)  Operational Phase  Telemetry & Incident Findings 
Oct 13–14, 2026  Initial Reconnaissance  Password spraying targeting legal tenants using curl/7.88.1 from 144.172.64.128. 
Oct 14, 2026  Vendor Detection  ConnectWise identifies preliminary unauthorized activity in Cloud Backup environments. 
Oct 15  Automated Token Harvest  Scripted GUID-sorted tenant traversal harvests Graph tokens via stolen client secrets. 
Oct 15  Privilege Escalation Wave  Manual post-exploitation targeting 16 high-value tenants; self-role assignments occur. 
Oct 17  Vendor Containment  ConnectWise disables 7 application identities and revokes connection certificates. 
Oct 17–18, 2026  Active Remediation  Industry-wide threat hunting, secondary secret purging, and role revocations. 

‍

Technical Exploitation Mechanics & TTPs

Modern SaaS management platforms rely heavily on non-human identities (NHIs) operating through OAuth 2.0 multi-tenant application registrations. To perform cloud-to-cloud backups, migrations, and management, ConnectWise applications require broad application-level permissions—such as Directory.ReadWrite.All, Exchange.ManageAsApp, and Files.ReadWrite.All.

By acquiring the vendor-side client secret (API secret) for ConnectWise’s core multi-tenant application registration, the adversary executed the OAuth 2.0 Client Credentials Grant flow (grant_type=client_credentials) directly against Microsoft's token endpoint (login.microsoftonline.com), introducing three critical security bypasses:
‍

  • Bypass of User-Centric Controls: Because the client credentials flow authenticates an application rather than a human user, safeguards such as Multi-Factor Authentication (MFA), password rotation policies, and interactive sign-in challenges are completely bypassed.
  • Evasion of Standard Conditional Access: Unless an organisation has explicitly configured specialised Workload Identity Conditional Access policies, service principal authentications ignore standard location restrictions, device compliance checks, and user risk evaluations.
  • Immediate Inheritance of High Privileges: Upon receiving a valid access token, the attacker inherits all application permissions granted to ConnectWise during initial onboarding—providing immediate read and write access to Exchange mailboxes, SharePoint libraries, OneDrive files, and Microsoft Teams channels across all consented customer tenants.
Post-Exploitation Tactics & Persistence Mechanisms

Once authenticated to target tenants, the threat actor executed three primary post-exploitation actions:

  • Privilege Escalation via Role Self-Assignment: The compromised ConnectWise Cloud Management - MS Teams application (24205314-2b89-4e07-a2a4-579e898a5640) assigned itself the Exchange Administrator or Global Administrator role, escalating its authority from scoped API access to full tenant-wide administrative control.
  • Backdoor Persistence in Third-Party Apps: Using self-assigned Global Administrator rights, the attacker injected new client secrets into other trusted enterprise applications within victim tenants. In one observed intrusion, within five minutes of initial access, the actor ran a Python script (Python-urllib/3.12) to append new client secrets to an MSP management utility and a single-tenant Huntress Security Platform application. This ensured the attacker retained administrative control through secondary applications even after ConnectWise suspended its services and rotated its primary credentials.
  • Directory Reconnaissance & Covert Email Exfiltration: Through Microsoft Graph API calls, the actor dumped user lists, group memberships, and tenant configurations. To establish covert exfiltration channels, the adversary created unauthorised organisation-level Exchange Online transport rules (mail flow rules) and inbox forwarding rules on administrative accounts to silently redirect sensitive emails to external attacker-controlled addresses.
Remediation, Mitigation & Forensic Playbook

Security operations teams must execute a two-stage response: immediate incident containment and eradication, followed by structural hardening of Non-Human Identities (NHIs).

‍
Part 1: Immediate Incident Response Playbook
Response Phase  Required Technical Actions  Critical Operational Guidance 
Phase 1: Immediate Containment  Locate ConnectWise enterprise apps in Entra ID and toggle Enabled for users to sign-in to No.  Do NOT delete the application registration. Deleting the application destroys consent logs, breaks forensic chain-of-custody, and prevents historical activity tracking. 
Phase 2: Token Invalidation  Monitor Graph API activity logs for 60 to 90 minutes post-containment to track active token decay.  Disabling an app prevents new token issuance, but previously issued OAuth access tokens remain active until natural expiration. 
Phase 3: Backdoor Eradication  Export ApplicationManagement audit logs from Oct 13 onward; inspect all enterprise apps for new secrets.  Purge all unverified client secrets and certificates added to secondary applications (especially MSP and security agent tools). 
Phase 4: Permission & Rule Audit  Revoke self-assigned directory roles (Exchange Admin, Global Admin); audit Exchange transport rules.  Delete unauthorized organizational transport rules and user-level inbox forwarding settings. 
Phase 5: Secure Restoration  Maintain apps in disabled state until ConnectWise confirms complete credential rotation across their infrastructure.  Once confirmed, set Enabled = Yes, re-evaluate Workload Identity Conditional Access, and enforce heightened log monitoring for 72 hours. 
Part 2: Long-Term Architectural Hardening for Non-Human Identities

Enforce Workload Identity Conditional Access: Deploy Microsoft Entra Workload ID Conditional Access policies specifically targeting service principals to restrict application authentication to trusted vendor egress IP ranges and block access from unrecognised geographic locations.

Deploy Workload Identity Risk Detection & Real-Time Alerts: Enable Microsoft Entra Workload ID Protection and configure real-time SIEM alerts for:

  1. Service principal authentications originating from unrecognised, non-Azure public IP addresses or scripting user-agents (e.g., Python-urllib, curl, python-requests).
  1. Directory role assignments where the initiating actor is a service principal rather than a human administrator or approved PIM workflow.
  1. Newly generated client secrets or certificates appended to existing Enterprise Applications or App Registrations.

Enforce Least-Privilege Application Consent & Role Restraints:

  1. Restrict Admin Consent: Implement strict administrative consent workflows so end-users and junior IT staff cannot grant consent to multi-tenant applications requesting high-privilege scopes (Directory.ReadWrite.All, Exchange.ManageAsApp).
  1. Block Self-Elevation: Use Entra ID Application Management Policies to restrict service principals from granting permissions to themselves or modifying directory roles.
  1. Audit Standing Permissions: Routinely review consented enterprise applications to ensure third-party SaaS and backup tools hold only minimal required permissions, removing standing roles such as Global Administrator.

Enable and Stream Microsoft Graph Activity Logs: Standard Entra ID sign-in logs only confirm that an application obtained an access token; they do not record which specific mailboxes, files, or API endpoints were queried. Configure diagnostic settings to stream MicrosoftGraphActivityLogs to your SIEM to gain full visibility into API call volumes, requested resource URIs, and potential bulk data exfiltration.

Implement Automated Mail Flow & Forwarding Rule Monitoring: Configure Defender for Office 365 and SIEM detections for:

  1. New Exchange Online transport rules configured to redirect, blind-copy (BCC), or forward messages to external domains.
  1. Modifications to organisation-wide remote domain settings that permit automatic external email forwarding.
  1. User-level inbox forwarding or hiding rules created on privileged accounts.

Perform Offboarding and Dormant Identity Cleanup: Regularly audit Entra ID for dormant third-party integrations, legacy migration utilities, and retired MSP management tools. Applications left consented from previous vendor relationships retain persistent background permissions and serve as prime targets for supply-chain pivot attacks.

‍