CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

ConnectWise Cloud Management

product · product:connectwise-cloud-management

Coverage
1
first 2026-10-18 → last 2026-10-18
Latest activity
2026-10-18
ConnectWise SkyKick app credential used in 162+ Microsoft 365 tenants; disabling it does not undo planted…
Peak priority
high
1 high
Targets
technology
sectors: technology
Sources cited
4
4 hosts

Action items (2)

Do-now tasks recorded on the entries about ConnectWise Cloud Management, newest first. Check the date before acting on an older one.

  • In every Entra tenant you or your MSP administer, find the seven ConnectWise application identities by client ID (Cloud Backup is 506e08f9-6e9a-4da4-942b-a099a03644ae; the other six are in ConnectWise's advisory), dormant SkyKick connections included, and disable them without deleting, then keep them disabled until ConnectWise gives restoration instructions; preserve the sign-in and audit logs promptly without delaying containment, because Entra ID Free keeps only 7 days.
    2026-10-18ConnectWise SkyKick app credential used in 162+…
  • In the same tenants review every enterprise application and app registration, MSP management and security tools first, for client secrets, certificates and federated credentials added since 2026-10-13 and remove any you did not create; also check the directory roles, owners and consent grants held by ConnectWise and SkyKick service principals, Conditional Access exclusions for them, and mailbox forwarding, inbox and transport rules and delegated access, because disabling the vendor applications does not remove access planted through them.
    2026-10-18ConnectWise SkyKick app credential used in 162+…

Defender insights

What each entry about ConnectWise Cloud Management tells a defender to do, newest first.

2026-10-18HIGHexploitedConnectWise SkyKick app credential used in 162+ Microsoft 365 tenants; disabling it does not undo planted access

Exposure · triage · detection

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

affected by

Story timeline

  1. 2026-10-18ConnectWise Cloud Backup (formerly SkyKick): the vendor's Microsoft 365 application credential was used to sign in to customer tenants, with directory-role self-assignments in about 50 tenants and added credentials in one
    active-threatsConnectWise SkyKick app credential used in 162+ Microsoft 365 tenants; disabling it does not undo planted access

Hunting pivots

Releases covered
ConnectWise Cloud Management
Tags
actively-exploitedcloudidentitysupply-chain
ATT&CK techniques (5 across 5 tactics)

5 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts: Cloud Accounts · Trusted Relationship
  • PersistenceValid Accounts: Cloud Accounts · Account Manipulation: Additional Cloud Credentials · Account Manipulation: Additional Cloud Roles
  • Privilege EscalationValid Accounts: Cloud Accounts · Account Manipulation: Additional Cloud Credentials · Account Manipulation: Additional Cloud Roles
  • StealthValid Accounts: Cloud Accounts
  • Credential AccessBrute Force: Password Spraying

Initial Access TA0001

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

T1199Trusted Relationship×1

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Evidence: 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

Persistence TA0003

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

T1098.001Account Manipulation: Additional Cloud Credentials×1

Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

Evidence: 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

T1098.003Account Manipulation: Additional Cloud Roles×1

An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments. With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).

Evidence: 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

Privilege Escalation TA0004

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

T1098.001Account Manipulation: Additional Cloud Credentials×1

Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

Evidence: 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

T1098.003Account Manipulation: Additional Cloud Roles×1

An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments. With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).

Evidence: 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

Stealth TA0005

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

Credential Access TA0006

T1110.003Brute Force: Password Spraying×1

Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords.

Evidence: 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

Entries about ConnectWise Cloud Management (1)

2026-10-18 · view entry permalink →

HIGHexploitedNATOA1

ConnectWise Cloud Backup (formerly SkyKick): the vendor's Microsoft 365 application credential was used to sign in to customer tenants, with directory-role self-assignments in about 50 tenants and added credentials in one

ConnectWise says it identified unauthorized access to application identities within its Cloud Backup (formerly SkyKick) environment; on 2026-10-17 it disabled seven application identities, suspended the service, says the shared Cloud Backup credentials are no longer valid, and warns that disabling does not reverse changes already made in a tenant (ConnectWise, 2026-10-18). Huntress and Todyl report that on 2026-10-15 the app's identity signed in to customer Microsoft 365 tenants from one hosting-provider address and received app-only Microsoft Graph tokens; the credential sits in the vendor's own tenant, so no user, MFA prompt or user Conditional Access was involved, and the app's consent covers read and write access to mail, files and Teams chats (Huntress, 2026-10-16; Todyl, 2026-10-15). Huntress confirmed unauthorized sign-ins in 162 tenants by 2026-10-16 and later counted almost 1,000 tenants with sign-in activity from that address, over 300 successful, after password spraying against four law-firm tenants on 13 and 14 October, and a separate failed wave targeted 16 tenants in policy and national-security sectors (Huntress, 2026-10-16). In about 50 of its tenants, ConnectWise Cloud Management apps assigned themselves directory roles, mostly Exchange Administrator; in one the Teams app added itself to Global Administrator and client secrets were added to an MSP management application and to Huntress's own application within about five minutes, the credential additions from private Azure space (Huntress, 2026-10-16). Microsoft Threat Intelligence, as BleepingComputer relays it, called it an active supply-chain attack and assessed likely abuse of existing permissions including Directory.ReadWrite.All (BleepingComputer, 2026-10-17). How the credential was obtained, who is behind it and what was read remain unknown (ConnectWise, 2026-10-18; BleepingComputer, 2026-10-17).

Triage: the vendor's apps sign in from Azure addresses with a .NET SDK user agent, while the credential additions used a Python user agent; Python and curl are common in administration, so Huntress says the combination of actor, operation and user agent is the signal (Huntress, 2026-10-16). Role self-assignments carrying the vendor's own user agent are not proven benign, since Huntress has not confirmed vendor automation (Huntress, 2026-10-16).

We recently identified unauthorized access to application identities within the ConnectWise Cloud Backup environment.

Disabling the affected connections prevents new authentication through those connections; it does not reverse changes previously made inside a tenant.

Whether a product vulnerability contributed has not been established.

ConnectWise Trust Center (advisory) 2026-10-18

As of 19:00 UTC on October 16, Huntress has confirmed unauthorized sign-ins in 162 tenants.

The credential type was a client assertion, which means the credential lives in the vendor's own tenant.

These tenants are in the policy, national security, trade, and critical mineral sectors.

Huntress 2026-10-16

Because the application already held broad, previously granted permissions in each tenant, those sign-ins gave the attacker the technical ability to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats.

Revoking user sessions does not end this access.

Todyl 2026-10-15
incident18 Oct 03:30Zmulti-sourceOpen finding →
Sources: ConnectWise Trust Center (advisory) · Huntress · Todyl · BleepingComputer

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • bleepingcomputer.com1 (25%)
  • connectwise.com1 (25%)
  • huntress.com1 (25%)
  • todyl.com1 (25%)
All cited sources (4)