Actor Profile

The threat actor behind this campaign remains unattributed. The adversary demonstrated operational sophistication by compromising a Microsoft 365 application credential belonging to ConnectWise Cloud Backup (formerly SkyKick), a cloud-based backup service for managed service providers. Motivation appears to be broad data access across MSP customer environments, leveraging the extensive permissions granted to the legitimate backup application. The actor's use of scripted, sequential tenant enumeration (sorted by GUID order) and prior password spraying activity against law firm tenants suggests reconnaissance and systematic exploitation capabilities. The same infrastructure (144.172.64[.]128) was observed in password spraying attempts on October 13-14, 2026, indicating sustained targeting of MSP-connected environments.

TTPs (Tactics, Techniques, Procedures)

The campaign leverages compromised application credentials to obtain Microsoft Graph tokens with inherited permissions (T1550.001: Use Alternate Authentication Material - Application Access Token). The actor authenticated to Microsoft Graph as the legitimate ConnectWise Cloud Backup application, bypassing traditional user authentication controls. Initial access likely involved credential theft or compromise of the vendor application's secrets. The adversary conducted password spraying (T1110.003: Brute Force - Password Spraying) against law firm tenants prior to the main campaign. In at least one tenant, a separate ConnectWise app (Cloud Management for Teams) assigned itself Global Administrator privileges (T1098.003: Account Manipulation - Additional Cloud Roles) and executed a Python script to add client secrets to other trusted applications (T1098.001: Account Manipulation - Additional Cloud Credentials), enabling persistence and lateral movement across MSP customer environments. The actor moved through 173 tenants in sorted GUID order within a two-hour window, indicating automated enumeration from a pre-compiled target list. Access includes mailbox reading (T1114.002: Email Collection - Remote Email Collection), file access via OneDrive/SharePoint (T1213.002: Data from Information Repositories - SharePoint), and Teams chat collection, with some directory read operations leaving no audit trail.

Targets & Patterns

The campaign specifically targets managed service providers (MSPs) and their downstream customers across cloud services, IT services, and MSP sectors. The compromised ConnectWise Cloud Backup credential provided access to 173 partner/customer M365 tenants where the application was consented. Targeting pattern indicates the actor possessed a pre-compiled list of tenant GUIDs, suggesting prior reconnaissance or access to ConnectWise customer data. Law firms were specifically targeted with password spraying attempts on October 13-14, 2026, indicating potential interest in legal sector data. The attack vector exploits the trust relationship between MSPs and their clients—the backup application's broad permissions (mailboxes, OneDrive, SharePoint, Teams, directory data) make it an attractive target for adversaries seeking scalable access across multiple organizations. The privilege escalation to Global Administrator and credential addition to MSP management applications demonstrates intent to establish persistent access across the MSP's entire customer base, not just individual tenants. This supply chain-style attack maximizes impact by compromising a single vendor credential to reach hundreds of downstream organizations.

Historical Context

This incident represents an evolution in supply chain attacks targeting the MSP ecosystem, similar in approach to previous campaigns exploiting trusted vendor relationships. The technique of compromising a widely-deployed third-party application credential mirrors tactics seen in other cloud-focused intrusions where adversaries abuse legitimate service provider access. The article references a concurrent "ephemeral supply chain tampering" campaign against AOMEI Backupper by threat actors delivering CROSSROAD and SHINYROAD malware, indicating a broader trend of targeting backup and recovery infrastructure. The ConnectWise incident follows the pattern of adversaries increasingly focusing on cloud service providers and MSP tools as force multipliers, where a single compromise yields access to numerous downstream customers. The password spraying activity against law firms on October 13-14, 2026, preceding the main campaign on October 15, suggests the same actor conducted reconnaissance before deploying the compromised credential. No direct links to previously named campaigns or APT groups are established in the available data.

Defensive Recommendations

  • Immediately disable ConnectWise Cloud Backup (application ID 506e08f9-6e9a-4da4-942b-a099a03644ae) in all M365 tenants until vendor confirms credential rotation; note that already-issued tokens remain valid for up to 90 minutes post-disable
  • Hunt for unauthorized service principal sign-ins by filtering Entra ID Service Principal Sign-in logs for ConnectWise application IDs (506e08f9-6e9a-4da4-942b-a099a03644ae and 24205314-2b89-4e07-a2a4-579e898a5640) with authentication from non-Azure IP ranges, particularly 144.172.64[.]128 between October 13-15, 2026
  • Audit Entra ID logs for privilege escalation events (T1098.003) where ConnectWise or SkyKick applications added themselves to directory roles, especially Global Administrator, since October 13, 2026
  • Review all trusted applications for unauthorized credential additions (T1098.001) by checking for new client secrets added to MSP management tools and security applications via Python-urllib/3.12 user agent or similar scripted activity
  • Enable Microsoft Graph activity logs to capture directory read operations that normally leave no audit trail; implement conditional access policies requiring device compliance and MFA for service principal authentication where feasible
  • Establish baseline monitoring for service principal authentication patterns, alerting on sequential tenant access in short timeframes or authentication from unexpected geographic locations/IP ranges outside known cloud provider infrastructure