Critical ConnectWise ScreenConnect flaw lets attackers hack Microsoft 365 accounts

Key Takeaways

• A stolen credential for ConnectWise Cloud Backup enabled unauthorized access to 173 Microsoft 365 partner and customer tenants.
• The attackers leveraged the backup application’s existing broad permissions, bypassing traditional user authentication and MFA.
• A second ConnectWise application was observed assigning itself Global Administrator roles and planting new, long-expiry client secrets.
• Organizations must review app secrets, audit logs for suspicious activity, and disable compromised service principals.

Attackers Leverage Stolen ConnectWise Credential to Breach Microsoft 365 Tenants

A significant supply chain attack has surfaced, where a compromised credential from ConnectWise Cloud Backup was exploited to gain unauthorized entry into 173 Microsoft 365 partner and customer environments. This incident underscores the profound risk associated with a single leaked vendor secret when a multi-tenant application possesses extensive permissions across numerous organizations.

The core of the attack targeted ConnectWise Cloud Backup, previously known as SkyKick Backup. This platform is widely utilized by Managed Service Providers (MSPs) to safeguard data within Microsoft 365 and Google Workspace. For its operational requirements, the Microsoft 365 application is typically granted broad access to critical services, including Exchange mailboxes, OneDrive, SharePoint, Teams, and directory information.

Microsoft Threat Intelligence has publicly acknowledged and is actively monitoring this ongoing supply chain attack, confirming the involvement of ConnectWise Cloud Backup (formerly SkyKick Backup).

Compromised Credential Exploited Across Numerous Tenants

Huntress confirmed that an API secret, originating from the vendor itself, was compromised and subsequently used to facilitate unauthorized Microsoft 365 access. Initial reports indicated 173 affected partner and customer tenants. Analysis of the login records revealed a “client assertion,” indicating that the secret was sourced directly from the vendor’s home tenant rather than through a password or action within individual customer environments.

The attackers specifically utilized the ConnectWise Cloud Backup application ID 506e08f9-6e9a-4da4-942b-a099a03644ae. On October 15, 2026, the application initiated sign-ins from the IP address 144.172.64[.]128, acquiring Microsoft Graph access tokens between 06:13 and 08:34 UTC. The rapid, sequential progression through tenant identifiers, often mere seconds apart, strongly suggests the use of an automated script targeting a pre-compiled list.

Crucially, this was not a typical user login. The threat actor authenticated as the trusted application itself, thereby receiving tokens imbued with the extensive permissions previously granted by customers. This method circumvented the need for user passwords and standard multi-factor authentication (MFA) prompts, as the activity relied on an app-only identity.

Global Administrator Access and Persistence Mechanisms Observed

The most severe observed activity occurred within one Huntress partner tenant. A second application, identified as ConnectWise Cloud Management – MS Teams (application ID 24205314-2b89-4e07-a2a4-579e898a5640), assigned itself the Global Administrator role. Following this privilege escalation, a Python script was used to inject new client secrets into two other trusted applications.

These newly added secrets were configured with an expiration date in 2028, creating a persistent backdoor that could allow the attackers to regain access through the compromised applications. Simply disabling the original ConnectWise applications will not remove these credentials planted in other app registrations. Therefore, defenders must meticulously review all app secrets and certificates, extending beyond just the ConnectWise entries.

Microsoft sign-in logs also documented the second application connecting from the private IPv6 range fde4:8dba:2600:37ce:6d26:200:a76:*. However, Huntress cautioned that legitimate ConnectWise and unrelated customer traffic can also originate from this same internal Microsoft cloud range. Consequently, this IP address alone should not be considered definitive proof of malicious activity.

This incident aligns with a broader trend of increased abuse of OAuth and service principals. Previous reports have highlighted how attackers leverage OAuth applications within Microsoft Entra ID for persistence, even after password resets. Another recent investigation detailed an 81 million-login Microsoft 365 password spray campaign that exploited Azure CLI and legacy OAuth flows.

Security teams should prioritize reviewing the “Service principal sign-ins” view within the Microsoft Entra admin center, as this activity will not appear in the default user sign-in page. Recommended filters include the Cloud Backup application ID, searches for 144.172.64[.]128, any unusual public IP addresses, and unexpected Graph API activity.

ConnectWise has also listed Python-urllib/3.12 and python-requests/2.31 as observed user agents. While Python tools are common in legitimate administration, these user agents alone are weak indicators. Stronger evidence emerges when linking the user agent with the source IP, application ID, observed role changes, and specific actions such as “Add service principal credentials” or “Update application.”

What You Should Do

• Review Entra Audit Logs: Inspect audit logs for any ConnectWise or SkyKick applications adding themselves to directory roles.
• Inspect Enterprise Applications and App Registrations: Scrutinize every enterprise application and app registration for client secrets or certificates added since October 13, 2026.
• Disable Service Principals: Impacted organizations should disable, but not delete, the ConnectWise Cloud Backup and ConnectWise Cloud Management – MS Teams service principals. Disabling pauses automated backups without deleting existing ones.
• Remove Unauthorized Roles and Credentials: Remove any unapproved directory roles and delete unknown app credentials.
• Review Conditional Access Exclusions: Examine and adjust any Conditional Access exclusions that might have been exploited.
• Maintain Disabled Status: Keep affected applications disabled until ConnectWise confirms all vendor secrets have been reset.
• Consult Technical Investigation: Refer to the detailed checks and updated indicators provided in the Huntress technical investigation.
• Prioritize Action: Act on confirmed sign-ins and persistence indicators immediately, rather than waiting for definitive proof of data exfiltration, as some Graph directory reads leave minimal audit trails.

Indicators of Compromise

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.