One Stolen Credential, 173 Breached Tenants: Inside the ConnectWise Cloud Backup OAuth Attack
Executive Summary
On October 15, 2026, unknown threat actors exploited a compromised OAuth credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to 173 Microsoft 365 tenants. Operating from IP address 144.172.64.128 between 06:13 and 08:34 UTC, attackers scripted through tenants in sorted GUID order, harvesting Microsoft Graph tokens and inheriting the application's broad permissions—full mailbox access, OneDrive, SharePoint, Teams, and directory data. In at least one tenant, a ConnectWise app elevated itself to Global Administrator and injected credentials into trusted third-party applications, extending the blast radius across the MSP customer ecosystem.
This incident underscores the accelerating abuse of trusted OAuth applications and MSP supply-chain vectors as force-multipliers for attackers. A single compromised vendor credential cascaded across 173 organizations simultaneously, illustrating how identity-centric supply-chain attacks are rapidly displacing traditional network-based intrusions as the dominant enterprise threat pattern in 2026.
Why This Matters Now
MSPs and their downstream clients face immediate exposure: ConnectWise Cloud Backup remains installed across thousands of tenants, and issued tokens stay valid up to 90 minutes after revocation. With Microsoft confirming active exploitation of AppId 506e08f9-6e9a-4da4-942b-a099a03644ae and directory-write permissions already abused to backdoor privileged apps, every organization relying on third-party OAuth integrations must audit service principal sign-ins and credential grants today—not after confirmation of data loss.
Attack Path Analysis
Threat actors compromised a privileged OAuth application credential belonging to ConnectWise Cloud Backup, enabling authenticated access to Microsoft Graph tokens across 173 M365 tenants without any per-tenant phishing or exploitation. Using a scripted enumeration loop, the attacker traversed tenants in GUID order, escalated privileges by assigning Global Administrator roles to a ConnectWise-managed app, added backdoor credentials to trusted third-party applications, conducted reconnaissance via Microsoft Graph API, and positioned for broad mailbox, OneDrive, SharePoint, and Teams data exfiltration across every affected tenant.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers obtained the ConnectWise Cloud Backup OAuth application credential (AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae) outside of any customer tenant, likely through a breach of ConnectWise's own credential store or supply-chain exposure. Prior to the primary campaign, the same source IP (144.172.64.128) conducted password spraying against four law firm tenants on October 13-14, suggesting credential harvesting reconnaissance. The compromised vendor credential granted the actor pre-authorized access to all tenants where the backup app had been consented, bypassing per-tenant authentication entirely. CNSF relevance: Cloud Native Security Fabric (CNSF) inline enforcement and anomaly detection at the identity/OAuth layer could have flagged the credential exfiltration or unusual authentication originating from a non-Azure IP range at the point of initial token issuance.
MITRE ATT&CK® Techniques
Valid Accounts: Cloud Accounts
Use Alternate Authentication Material: Application Access Token
Account Manipulation: Additional Cloud Roles
Account Manipulation: Additional Cloud Credentials
Gather Victim Network Information: Domain Properties
Data from Cloud Storage
Brute Force: Password Spraying
Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NYDFS 23 NYCRR 500 – Monitoring of Authorized User Access and Privileged Actions
Control ID: 500.14(b)
DORA (Digital Operational Resilience Act) - EU 2022/2554 – Third-Party ICT Service Provider Risk Management
Control ID: Article 28 – ICT Third-Party Risk
NIS2 Directive (EU 2022/2555) – Supply Chain and Third-Party Security Controls
Control ID: Article 21(2)(d) – Supply Chain Security
CISA Zero Trust Maturity Model 2.0 – Service Principal and Application Identity Governance
Control ID: Identity Pillar – Advanced: Continuous Validation of Non-Human Identities
PCI DSS 4.0 – Management of Application and System Accounts
Control ID: Requirement 8.6
ISO/IEC 27001:2022 – Information Security in Supplier Relationships / ICT Supply Chain Security
Control ID: Annex A 5.19 / 5.23
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
MSPs using ConnectWise Cloud Backup face supply-chain credential compromise across 173 M365 tenants, enabling lateral movement, mailbox exfiltration, and OAuth backdoor persistence via inherited Global Administrator privileges.
Financial Services
Password spraying against law firm and financial tenants, combined with Directory.ReadWrite.All permissions abuse, creates critical PCI 4.0 and NIST.800-53.SC-7 compliance exposure requiring immediate Zero Trust segmentation remediation.
Law Practice/Law Firms
Confirmed password spraying targeting four law firm M365 tenants escalates privileged access risk; compromised SharePoint, Teams, and mailbox data triggers urgent NIST.CSF.PR.DS-5 egress security and data exfiltration controls.
Computer/Network Security
Attacker added credentials to Huntress's own OAuth application, weaponizing trusted security tooling itself; underscores multicloud visibility gaps and ZTMM.CrossCutting.Visibility failures in supply-chain credential compromise scenarios.
Sources
- Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenantshttps://thehackernews.com/2026/10/hackers-use-compromised-connectwise.htmlVerified
- Vendor Credential Enables Unauthorized Access Across Customer Tenants - Huntresshttps://www.huntress.com/blog/vendor-credential-enables-unauthorized-accessVerified
- ConnectWise Trust Center Advisory - Unauthorized Access to Cloud Backup Application Identitieshttps://www.connectwise.com/company/trust/advisoriesVerified
- Investigation: Unauthorized Access Through the ConnectWise Cloud Backup Microsoft 365 App - Todylhttps://www.todyl.com/blog/investigation-unauthorized-access-through-the-connectwise-cloud-backup-microsoft-365-appVerified
- Microsoft Security Intelligence - Active Supply Chain Attack Tracking Statement (X/Twitter Post)https://x.com/MsftSecIntel/status/2111358888125878426Verified
- ConnectWise Status Page - Cloud Backup Service Incidenthttps://status.connectwise.com/Verified
- ConnectWise Cloud Backup Product Pagehttps://www.connectwise.com/platform/bcdr/cloud-backupVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because the attacker leveraged a single compromised OAuth credential to traverse 173 M365 tenants without re-authentication, a pattern that identity-aware segmentation and inline traffic observability could have constrained. By enforcing workload-scoped access boundaries and monitoring anomalous cross-tenant API traversal, CNSF would likely have reduced the attacker's effective blast radius across the MSP customer base.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Inline enforcement and anomaly detection at the identity and OAuth layer would likely have flagged authentication attempts originating from a non-Azure source IP, reducing the attacker's ability to quietly acquire valid tokens across consented tenants without generating observable signals.
Control: Zero Trust Segmentation
Mitigation: Identity-bound, least-privilege policy enforcement would likely have constrained the application's ability to self-assign elevated roles, limiting the scope of privilege escalation and reducing the reachability of backdoor credentials added to third-party applications across the tenant fabric.
Control: East-West Traffic Security
Mitigation: East-west traffic monitoring across workload-to-service and service-to-service flows would likely have detected the anomalous cross-tenant API traversal pattern, and identity-bound per-tenant policies could have meaningfully constrained how far a single credential set was permitted to pivot between distinct tenant contexts.
Control: Multicloud Visibility & Control
Mitigation: Centralized traffic observability and anomalous interaction detection would likely have flagged the non-Azure source IP conducting scripted Graph API enumeration, potentially reducing the attacker's dwell time by surfacing the behavioral pattern before backdoor credentials became entrenched.
Control: Egress Security & Policy Enforcement
Mitigation: FQDN-level filtering and outbound policy enforcement on Microsoft Graph API destinations would likely have detected volumetric and anomalous data access patterns, reducing the attacker's ability to conduct bulk tenant enumeration and data reads without generating egress-layer signals.
Had earlier CNSF controls constrained cross-tenant traversal and anomalous privilege escalation, the residual impact would likely have been narrowed to a smaller subset of tenants, with the backdoor credential footprint reduced in scope and the disruption to legitimate backup operations potentially avoided for the broader customer base.
Impact at a Glance
Affected Business Functions
- Microsoft 365 Tenant Administration and Identity Management
- Email and Mailbox Data Access (Exchange Online / EWS)
- Cloud File Storage and Collaboration (OneDrive, SharePoint, Teams)
- MSP-Managed Client Environment Security and Privileged Access Control
Estimated downtime: 7 days
Estimated loss: N/A
Confirmed unauthorized Microsoft Graph token acquisition across 173 partner and customer M365 tenants, exposing full mailbox contents (read/write via Exchange Web Services), OneDrive and SharePoint files, Microsoft Teams chat histories, and Azure Active Directory directory data. In at least one tenant, a ConnectWise application elevated itself to Global Administrator and added rogue credentials to trusted third-party applications including an MSP management platform and a security tool, potentially extending lateral access to all downstream customer tenants managed by those applications. Directory read operations via Microsoft Graph leave no audit trail, meaning the full scope of data accessed cannot be fully determined. Data at risk includes sensitive business communications, client files, identity and credential information, and any data accessible to privileged MSP management tools consented across the MSP's entire client portfolio. The population of affected organizations spans MSPs and their end clients across multiple sectors including legal, IT services, and professional services.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce Zero Trust Segmentation with least-privilege, identity-based policies on all OAuth application consent grants — no application should be able to self-assign Global Administrator or add credentials to third-party apps without explicit, time-bound, human-approved workflow controls aligned with ZTMM.Applications and NIST.800-53.AC-6.
- • Deploy Multicloud Visibility and Control with centralized traffic observability and anomaly baselining to detect scripted cross-tenant enumeration patterns, non-Azure source IPs authenticating as managed service applications, and anomalous Microsoft Graph API call volumes indicative of bulk data access (ZTMM.CrossCutting.Visibility, NIST.800-53.AU-6).
- • Implement Egress Security and Policy Enforcement with FQDN filtering and outbound policy rules to detect and alert on data exfiltration attempts via Microsoft Graph API from unauthorized source IPs, supplemented by Cloud Firewall (ACF) AI-driven traffic discovery to identify non-baseline egress behavior (ZTMM.Data, NIST.CSF.PR.DS-5, NIST.800-53.SC-18).
- • Apply Cloud Native Security Fabric (CNSF) inline enforcement at the OAuth token issuance and consent layer to detect and block credential abuse originating outside expected Azure private IPv6 ranges, enforce real-time inspection of service principal authentication activity, and trigger automated revocation workflows when anomalous patterns are detected (ZTMM.CrossCutting.Automation, NIST.800-53.SI-4).
- • Conduct immediate audit of all OAuth application credentials, service principal sign-in logs filtered by the identified AppIds, Entra role assignment changes since October 13, 2026, and any new client secrets added to privileged applications — then establish continuous East-West Traffic Security monitoring for workload-to-service API flows to detect future cross-tenant lateral movement attempts (ZTMM.Network, NIST.800-53.SC-7, NIST.CSF.DE.CM-1).
