On October 13, 2026, attackers began making scripted sign-in attempts against Microsoft 365 tenants using credentials tied to ConnectWise Cloud Backup, the managed backup service formerly known as SkyKick Cloud Backup. By October 17, ConnectWise had confirmed unauthorized access and suspended the service. By October 18, the count of confirmed compromised tenants had reached at least 173, and that figure almost certainly understates the total.
This is a supply-chain attack in the precise sense: the victim is not ConnectWise, and the initial foothold is not in your network. The victim is every MSP customer who granted the ConnectWise backup application access to their Microsoft 365 tenant.
How the attack worked
Microsoft 365 integrations for backup and management products rely on Entra ID service principals. The customer grants the backup application specific permissions, and the application signs in using its own credentials (a client secret or certificate) rather than a human user login.
This architecture is by design and broadly necessary. But it has a critical security property that attackers understand well: because the sign-in comes from an application identity, the MFA policies that protect your user accounts do not apply. The attacker who holds the application secret can authenticate directly, at scale, with no second factor.
In this case, the attacker obtained the credentials for ConnectWise's Cloud Backup service-principal identity. Whether those credentials were stolen from ConnectWise's infrastructure, leaked in a prior breach, or obtained through another method has not been publicly disclosed. Once in hand, they used scripted tooling (curl/7.88.1 and Python-based user agents) from a single IP address, 144.172.64[.]128, to authenticate against customer tenants.
What the attacker did
The attacker's behavior varied across victims. In some tenants, Huntress observed only sign-in activity with no visible changes. In others, Microsoft Threat Intelligence saw more aggressive activity: the Cloud Management application granted itself Global Administrator, added credentials to MSP management tools and to Huntress's own application, installed a backdoor, performed Graph API reconnaissance, and attempted to establish persistence.
The specific Entra ID permissions involved included Directory.ReadWrite.All, which allows reading and writing users, groups, and application registrations across the entire tenant.
Why MFA did not help
This is the part worth internalizing. Conditional Access policies and MFA requirements apply to user sign-ins. A service-principal sign-in is not a user sign-in. When the ConnectWise backup application authenticated against your tenant, no MFA prompt appeared anywhere, because no human was involved.
This is not a misconfiguration on your end. It is the intended behavior of application authentication in Microsoft Entra ID. The correct control is not MFA for application identities; it is restricting what those application identities can do, monitoring when and from where they authenticate, and rotating or removing them when they are no longer needed.
What to do right now
ConnectWise suspended the service Oct 17 and disabled seven application identities Oct 18. But previously issued access tokens remain valid until they expire, and any credentials the attacker planted in your tenant are not removed by ConnectWise shutting down the service.
Immediate steps:
Review Entra ID sign-in logs filtered by the SkyKick Cloud Manager or ConnectWise Cloud Backup application ID. Look for sign-ins from IP addresses outside your expected range, particularly 144.172.64[.]128 or any address not previously associated with the backup service.
Check all application registrations and enterprise applications in your tenant for secrets or certificates added since October 13. Revoke anything unexpected.
Look for OAuth grants and delegated permissions added since Oct 13, particularly for Microsoft Graph scopes related to mail, files, or directory write.
Review Teams and SharePoint audit logs if your service tier includes them. The attacker had permissions to read and write OneDrive, SharePoint, and Teams content in affected tenants.
Check other Cloud Management integrations that ConnectWise provides. The company said additional identities beyond the seven already disabled still need review.
The durable lesson
Backup and management tooling holds privileged access to your environment by design. If those credentials are compromised upstream at the vendor, the attack bypasses your perimeter, your MFA policies, and your endpoint detection tools entirely. The right response is not to avoid backup tools; it is to treat service principals with the same discipline you apply to privileged user accounts. Scope them to exactly what they need. Monitor their activity. Rotate credentials on a schedule. Build alerting for unexpected source IPs or new permission grants.
Supply-chain attacks through MSP tooling will keep happening because MSP tools hold high-value access to many environments simultaneously, and a single credential set unlocks all of them at once.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want to review your Entra ID service-principal posture or MSP supply-chain risk.