Ethical Hacking News
A recent cyberattack has been discovered, in which hackers are utilizing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. The attack, which was observed by cybersecurity researchers, involves the use of an unknown threat actor to abuse the compromised credential and gain access to multiple M365 tenants. The compromised credential was found to have been obtained by the threat actors and was used to obtain Microsoft Graph tokens in customer tenants from the IP address 144.172.64[.]128 on October 15, between 06:13 and 08:34 UTC. The threat actors were also able to assign themselves Global Administrator privileges and add credentials to other trusted applications within the customer environment. Users are advised to take proactive steps to protect themselves against similar attacks in the future, including disabling the application until ConnectWise confirms all credentials have been reset and enabling Microsoft Graph activity logs.
Hackers exploited a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup to gain unauthorized access to customers' M365 environments. The compromised credential granted access to multiple M365 tenants and permitted access to mailboxes, OneDrive, SharePoint, Teams, and directory data. Threat actors used the credential to obtain Microsoft Graph tokens, assign Global Administrator privileges, and add credentials to other trusted applications. The attack had a high potential impact, particularly if the credentials were used to access sensitive data or systems. ConnectWise has taken steps to close Cloud Backup application access and shared indicators of compromise with customers. Cybersecurity experts emphasize the need for robust security measures, including multi-factor authentication and regular security audits.
A recent cyberattack has been discovered, in which hackers are utilizing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. The attack, which was observed by cybersecurity researchers, involves the use of an unknown threat actor to abuse the compromised credential and gain access to multiple M365 tenants.
The compromised credential, which was found to have been obtained by the threat actors, is a broad access credential that permits the application to access mailboxes, OneDrive, SharePoint, Teams, and directory data in every tenant on which it is installed. The application in question is ConnectWise Cloud Backup, a cloud-based backup and recovery service designed for managed service providers (MSPs) to secure their clients' Microsoft 365 or Google Workspace data.
According to Huntress, a cybersecurity company that observed the attack, the compromised credential was used to obtain Microsoft Graph tokens in customer tenants from the IP address 144.172.64[.]128 on October 15, between 06:13 and 08:34 UTC. The threat actors then moved through the tenants in sorted GUID order, a few seconds apart, which suggests that the attack was carried out using a script working from a target list.
In addition to gaining access to customer data, the threat actors were also able to assign themselves Global Administrator privileges and add credentials to other trusted applications within the customer environment. This effectively extended the risk beyond the vendor account, as the threat actors were able to use the credentials to access other applications and data within the customer environment.
The attack was discovered by cybersecurity researchers, who warned that the compromised credential was in "hostile hands" and that the threat actors were able to use the credential to inherit the app's existing permissions. As a result, the attack is considered to have a high potential impact, particularly if the credentials are used to access sensitive data or systems.
In response to the incident, ConnectWise has taken the step of closing Cloud Backup application access until further notice. The company has also shared indicators of compromise (IoCs) with its customers, including the IP address 144.172.64[.]128, which is believed to be the source of the compromised credential.
Users are advised to disable the application until ConnectWise confirms all credentials have been reset, enable Microsoft Graph activity logs, audit for any new credentials added since October 13, 2026, and check Entra audit logs for ConnectWise or SkyKick applications adding themselves to a directory role.
The incident has also highlighted the importance of robust security measures, including the use of multi-factor authentication and regular security audits. Cybersecurity experts have emphasized the need for customers to take proactive steps to protect themselves against similar attacks in the future.
Furthermore, the incident has been linked to a broader supply chain compromise campaign, in which a previously undocumented threat cluster codenamed UNC7017 has been identified. The campaign, which occurred between April and July 2026, has been attributed to a previously unknown threat actor and has been reported to have impacted organizations across multiple sectors, including IT services, telecommunications, higher education, and related entities in various countries.
In conclusion, the recent cyberattack in which hackers exploited a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup has highlighted the importance of robust security measures and the need for customers to take proactive steps to protect themselves against similar attacks. The incident has also highlighted the importance of supply chain security and the need for organizations to be vigilant in protecting themselves against supply chain-based threats.
Related Information:
https://www.ethicalhackingnews.com/articles/Hackers-Exploit-Microsoft-365-Tenants-Using-Compromised-ConnectWise-Credential-ehn.shtml
https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html
https://hackerfeeds.com/news/hackers-use-compromised-connectwise-credential-to-sign-in-to-173-1aud5p
Published: Sat Oct 17 02:40:04 2026 by llama3.2 3B Q4_K_M
