Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts
Attackers used a stolen ConnectWise Cloud Backup secret to access 173 Microsoft 365 tenants.
Microsoft and Huntress say a stolen ConnectWise Cloud Backup API secret, formerly SkyKick Backup, was used to sign in to 173 Microsoft 365 partner and customer tenants. On October 15, 2026, application ID 506e08f9-6e9a-4da4-942b-a099a03644ae obtained Microsoft Graph tokens from 144.172.64.128 with app-only authentication, bypassing user passwords and MFA. In one tenant, a second ConnectWise app assigned itself Global Administrator and added client secrets expiring in 2028 to other trusted applications. ConnectWise said it had no indication partner backup data was accessed, and the actor has not been identified.
- A stolen ConnectWise Cloud Backup secret reached 173 Microsoft 365 tenants.
- October 15 sign-ins used app ID 506e08f9-6e9a-4da4-942b-a099a03644ae from 144.172.64.128.
- A second app granted itself Global Administrator and planted secrets expiring in 2028.
- ConnectWise reported no evidence that partner backup data was accessed.
- ATT&CK
- T1199 Trusted RelationshipT1078.004 Valid Accounts: Cloud AccountsT1550.001 Application Access TokenT1098.003 Account Manipulation: Additional Cloud RolesT1098.001 Account Manipulation: Additional Cloud Credentials
- Vendors
- ConnectWiseMicrosoft
- Organizations
- HuntressMicrosoft Threat IntelligenceConnectWise
From the original article
4 min read at cybersecuritynews.com
Hackers used a stolen ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 partner and customer tenants, giving them access through a trusted backup application. The incident shows how one leaked vendor secret can create risk across many organizations when a multitenant app already has wide permissions. The affected product is ConnectWise Cloud […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.