A compromised credential belonging to a trusted backup application has given attackers a single key into 173 Microsoft 365 tenants, in what Microsoft is calling an active supply chain attack. The credential belongs to ConnectWise Cloud Backup, formerly SkyKick, a service managed service providers use to back up and restore their clients' Microsoft 365 and Google Workspace data.
The problem is the access that job requires. To back up an environment, the application is consented into each tenant with broad permissions covering mailboxes, OneDrive, SharePoint, Teams and directory data. Whoever holds the application's credential inherits that same access in every tenant where the app is installed, without needing a user's password or a multifactor authentication prompt.
Huntress said it has confirmed unauthorized sign-ins in 173 partner and customer tenants. "The app's credential is in hostile hands," security researcher Jonathan Semon said. "It was used to obtain Microsoft Graph tokens in customer tenants from 144.172.64.128 on October 15, between 06:13 and 08:34 UTC. The actor moved through tenants in sorted GUID order, a few seconds apart, which points to a script working from a target list."
Huntress said the same address had engaged in password spraying against four law firm tenants on October 13 and 14, though it detected no successful user sign-ins there. Microsoft Threat Intelligence said the actor likely abused permissions customers had previously granted to the application, including highly privileged access such as Directory.ReadWrite.All, and that follow-on activity included Microsoft Graph reconnaissance and attempts to add new credentials to the service principal as a backdoor.
In at least one partner tenant, researchers found the risk spreading beyond the backup app itself. A separate ConnectWise application for Microsoft Teams assigned itself Global Administrator privileges, then added new client secrets to two other trusted applications in the tenant: an MSP management application and Huntress's own security platform. Adding a credential to an MSP tool is especially concerning, because those applications are often consented into many customer tenants at once.
ConnectWise has closed access to the Cloud Backup application until further notice while its investigation continues. The company said it has found no evidence that partner backup data stored by the service has been compromised. That assurance, however, does not settle what attackers may have read inside customer tenants while the credential was valid, and researchers note that some directory reads through Microsoft Graph leave little audit evidence.
Incident responders are urging every organization with the app installed to act now rather than wait for proof of data theft. Todyl noted that revoking user sessions does not end this kind of access: disabling the app in a tenant stops new tokens from being issued there, though tokens already issued can remain valid for up to 90 minutes, and any tenant where the app stays enabled remains exposed until ConnectWise rotates the credential.
Defenders should check service principal sign-ins in the Microsoft Entra admin center — not the default user tab — filtering for application ID 506e08f9-6e9a-4da4-942b-a099a03644ae and for addresses outside expected Microsoft and Azure ranges. They should also enable Microsoft Graph activity logs, audit for any credentials added since October 13, and check whether ConnectWise or SkyKick applications added themselves to a directory role. For MSPs and their clients, the lesson is stark: a vendor's single shared secret can become an enterprise-wide incident.