The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In October 2026, ConnectWise disclosed unauthorized access to application identities associated with its Cloud Backup product (formerly SkyKick), a SaaS solution serving managed service providers (MSPs). A threat actor used compromised API credentials to authenticate into Microsoft 365 Entra tenants across more than 1,000 organizations, with over 300 successful sign-ins confirmed by third-party researchers at Huntress and Todyl. The attacker escalated privileges to Global Administrator in at least two tenants and planted persistent backdoor credentials. ConnectWise responded by disabling Cloud Backup, SaaS Security, and Cloud Management services while engaging an incident response firm and revoking compromised certificates.

This incident exemplifies the accelerating risk of supply-chain credential abuse targeting MSP platforms. Attackers increasingly exploit the trusted, high-permission relationships between SaaS vendors and their downstream customers, turning a single compromised vendor identity into a master key across hundreds of enterprise Microsoft 365 environments—amplifying blast radius far beyond what a direct breach would achieve.

Why This Matters Now

MSP-targeting supply chain attacks are surging in 2026, with threat actors systematically exploiting delegated SaaS credentials that grant Global Administrator access to thousands of downstream tenants simultaneously. Regulatory scrutiny under frameworks like NIST CSF 2.0 and CISA's Secure by Design initiative is intensifying, making vendor-side identity hygiene and third-party access governance an immediate compliance and operational imperative for any organization relying on managed services.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Attackers compromised an API secret (application identity credential) belonging to ConnectWise Cloud Backup, which had been granted broad delegated permissions inside customer Microsoft 365 and Entra environments. This single credential functioned as an authentication key across every tenant where the application was consented, enabling unauthorized sign-ins at scale.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

This incident demonstrates how a single compromised SaaS application identity cascaded across more than 1,000 Microsoft 365 tenants, exploiting the absence of workload-level segmentation and identity-scoped access boundaries. Aviatrix Zero Trust CNSF would likely reduce attacker reachability by enforcing strict segmentation between vendor and customer environments, limiting the blast radius of a shared credential compromise.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: A Zero Trust fabric treating vendor application identities as untrusted by default could likely reduce the reachability of stolen credentials across downstream tenant environments, limiting how far a single compromised API secret may propagate through the MSP supply chain.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation enforcing least-privilege access boundaries could likely constrain the attacker's ability to propagate escalated privileges across segmented workload zones, reducing the operational scope of newly granted Global Administrator roles within cloud environments.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic enforcement between tenant-scoped workload segments could likely reduce the attacker's ability to freely pivot across customer environments, constraining sequential cross-tenant traversal by requiring explicit policy authorization for each lateral access path rather than inheriting access through a shared application identity.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Centralized multicloud visibility across cloud traffic paths could likely surface anomalous authentication sweep patterns from a single external IP, reducing the attacker's ability to conduct repeated cross-tenant credential sweeps undetected within the noise of legitimate SaaS API traffic.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Controlled egress policy enforcement governing outbound data paths from cloud workloads could likely constrain bulk data movement from consented M365 workloads toward external destinations, reducing the feasible volume of data that may exit across backup stores, mailboxes, and SharePoint environments under attacker control.

Impact (Mitigations)

Had earlier segmentation and egress constraints reduced the attacker's lateral reach, the residual impact would likely involve a smaller number of affected tenant environments, limiting persistent backdoor deployment and reducing the number of critical-sector organizations facing active credential exposure and backup service disruption.

Impact at a Glance

Affected Business Functions

  • Microsoft 365 Cloud Backup and Restore Services
  • MSP-Managed Tenant Administration and SaaS Security Monitoring
  • Exchange Online, SharePoint, OneDrive, and Microsoft Teams Data Access
  • Cloud Management and Partner Identity Administration
Operational Disruption

Estimated downtime: 14 days

Financial Impact

Estimated loss: N/A

Data Exposure

The incident exposed application-level credentials (API secrets) tied to ConnectWise Cloud Backup, granting threat actors potential access to Microsoft 365 tenant data across MSP customer environments. Affected data categories include Exchange Online mailbox content, SharePoint documents, OneDrive files, Microsoft Teams messages, and Entra identity configurations. Over 1,000 Entra tenants were observed with sign-in attempts from the malicious IP address, with more than 300 successful authentications confirmed by Huntress. In at least two tenants, the attacker escalated the ConnectWise application to Global Administrator and established persistence by adding credentials for additional applications. A pre-built list of SkyKick partner tenant IDs is suspected to have been exfiltrated from vendor-side records, potentially exposing MSP partner metadata. The full scope of data access in live Microsoft 365 environments remains unconfirmed due to limited vendor-side visibility, but the breadth of permissions granted to the Cloud Backup application makes sensitive enterprise data exposure a significant concern across hundreds of downstream MSP-managed organizations.

Recommended Actions

  • • Apply Zero Trust Segmentation (ZTMM.Network, NIST.800-53.AC-6) to enforce identity-based, least-privilege policies on all SaaS application identities — MSP-managed platforms must be segmented so a single compromised application credential cannot traverse all downstream tenant boundaries without re-authentication and per-tenant policy enforcement.
  • • Deploy Multicloud Visibility & Control (ZTMM.CrossCutting.Visibility, NIST.800-53.AU-6) to establish behavioral baselines for SaaS application authentication patterns; anomalous bulk sequential tenant access from a single IP — a clear indicator in this incident — should trigger automated alerting and session termination across all affected tenants simultaneously.
  • • Enforce Egress Security & Policy Enforcement (ZTMM.Data, NIST.CSF.PR.DS-5) on all cloud application outbound flows to prevent unauthorized data export via Microsoft Graph API or cloud storage copy operations; FQDN-level filtering and data loss prevention policies would limit the blast radius of credential abuse even after initial compromise.
  • • Leverage East-West Traffic Security controls (ZTMM.Network, NIST.800-53.SC-7) to block cross-tenant lateral movement by enforcing workload-to-workload and service-to-service policy boundaries within MSP shared infrastructure; cross-tenant API calls should require explicit per-tenant identity verification rather than relying on a shared application secret.
  • • Implement Cloud Native Security Fabric (CNSF) inline enforcement (ZTMM.CrossCutting.Automation, NIST.800-53.SI-4) as the primary control plane for real-time inspection of all cloud application authentication events and permission escalation attempts, ensuring that any application self-granting of Global Administrator roles triggers immediate automated revocation and incident response workflows.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image