Supply-chain attack via ConnectWise Cloud Backup gives attackers access to Microsoft 365 tenants
Attackers used the identity of a ConnectWise backup app to enter Microsoft 365 tenants; Huntress found at least 162 affected customer tenants.
ConnectWise suspended its Cloud Backup service, formerly SkyKick, on 17 October 2026 after detecting unauthorized access to application identities. Attackers used those identities to enter customers' Microsoft 365 tenants, and Microsoft described the incident as an active supply-chain attack.
According to a BleepingComputer report dated 17 October 2026, ConnectWise cut off customer access to Cloud Backup, the service previously sold as SkyKick Cloud Backup. In its advisory the company said someone had gained unauthorized access to the application identities used by Cloud Backup. Security firm Todyl says the attacker used the backup app's secret to sign in to Microsoft 365 directly as the app; because no user logged in, multi-factor authentication offered no protection.
- Malicious activity started from a single IP address on 15 October at the latest; Huntress also tied scripted sign-in attempts on 13 and 14 October to the same address.
- Huntress found at least 162 compromised Microsoft 365 tenants in the environments it monitors; in close to 50 tenants, ConnectWise Cloud Management apps gave themselves directory roles, most often Exchange Administrator.
- Microsoft assessed that the attacker likely abused existing permissions, including Directory.ReadWrite.All; Todyl says those permissions allowed reading and writing mail, OneDrive/SharePoint files and Teams chats.
- ConnectWise disabled seven application identities on 17 October and, as a precaution, also took SaaS Security and Cloud Management offline; it said there was no evidence that stored backups were compromised.
Why it matters
The incident points to how a single vendor problem can spread to many companies when third-party apps connected to Microsoft 365 hold broad permissions. Todyl warns that revoking user sessions does not end app-based access, and disabling an app does not invalidate tokens already issued until they expire. Companies in Türkiye that use Microsoft 365 would benefit from reviewing the permissions of third-party apps registered in Entra ID, even if they do not use the ConnectWise apps.
Administrators are advised to disable the ConnectWise apps, review Entra service principal sign-ins, OAuth grants and Graph activity, and check for secrets or certificates added since 13 October. In older tenants the apps may appear as SkyKick Cloud Manager.
Sources
More articles
Microsoft to process Claude models in Copilot inside the EU Data Boundary by the end of 2026
Microsoft says Anthropic's Claude models in Copilot will move into the EU Data Boundary. The target is the end of 2026, and the Claude setting is off by default in the EU and EFTA.
November 5, 2026 · Source: MicrosoftGoogle makes Gemini Omni 1.2 Flash video model generally available with clips up to 15 seconds
Google made its video generation and editing model Gemini Omni 1.2 Flash generally available on 5 November 2026. It is rolling out to the Gemini API, Google Cloud, Flow, Google Vids, the Gemini app and Google Ads.
November 5, 2026 · Source: Google BlogShopify's third-quarter revenue rises 32 percent to 3.74 billion dollars
In third-quarter results published on 3 November 2026, Shopify reported revenue up 32 percent and gross merchandise volume (GMV) up 29 percent. The company expects revenue growth in the low thirties percent again in the fourth quarter.
November 3, 2026 · Source: Shopify (SEC 8-K)