ConnectWise SkyKick Breach: How to Check Your Microsoft 365 Tenant
Summary
- Published
- Collected
📦 Full-Text Content Snapshot
R2 Archive · Full Article PreservedPublished on: 2026-10-17 · Source: specterops.io
ConnectWise SkyKick Breach: How to Check Your Microsoft 365 Tenant
Author
Read Time
5 mins
Published
Oct 17, 2026
[ ](mailto:?Subject=I%20thought%20you'd%20like%20this%20post:%20ConnectWise SkyKick Breach: How to Check Your Microsoft 365 Tenant &Body=https://specterops.io/blog/2026/10/17/connectwise-skykick-breach-microsoft-365/)
Put Insights Into Action
_Last updated October 19, 2026_ _at 16:45 UTC_
An attacker used a compromised credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to sign in to customers’ Microsoft 365 tenants. The credential belongs to the application itself, so the attacker inherited the permissions granted to it. Here’s what’s known so far and what to check in your own tenant.
_This blog will be updated and cross-linked as more information becomes available._
tl;dr
- On October 15, an attacker used the ConnectWise Cloud Backup application’s credential to get Microsoft Graph tokens in customer tenants.
- As of October 19, Huntress has identified nearly 1,000 Entra tenants with sign-in activity from the IP address associated with the unauthorized activity (
144.172.64[.]128), with approximately 300 of those sign-ins succeeding thus far.
- Disable the affected ConnectWise applications now, and review every application in your tenant for credentials added since October 13.
What happened in the ConnectWise SkyKick breach?
On October 15, 2026, between 06:13 and 08:34 UTC, the ConnectWise Cloud Backup application signed in to customer tenants from 144.172.64[.]128, a hosting provider address. According to Huntress, which first broke the news of the breach, the attacker moved through tenants a few seconds apart, which points to a script working from a target list.
According to The Hacker News, Microsoft is calling this an active supply chain attack, with the attackers likely abusing permissions customers had already granted the app, including Directory.ReadWrite.All.
As of the publication of this blog, ConnectWise has shut off Cloud Backup application access while it investigates. The company says it has found no evidence that partner backup data was compromised. How the attacker obtained the credential has not been disclosed.
Why doesn’t MFA stop this attack?
MFA doesn’t apply because this is an application sign-in, so no user, device, or MFA prompt is involved. Backup tools need broad access to read and restore data. Anyone holding the app’s credential can reach the same mailboxes, OneDrive and SharePoint files, Teams data, and directory information the backup service can.
In one tenant, Huntress also saw a second ConnectWise application grant itself Global Administrator and add new client secrets to two other trusted applications. That gives an attacker a way back in even after the original credential is reset.
Which known ConnectWise applications are affected?
Based on recommendations from Huntress and others, SpecterOps built and is actively running cypher queries (below) for the following known ConnectWise applications. The queries hunt for applications owned by the ConnectWise tenant (ID: 3f9cd7a0-127a-4ed4-bf06-2f830d5616b7). Older tenants may list them under SkyKick names. ant (ID: 3f9cd7a0-127a-4ed4-bf06-2f830d5616b7). Older tenants may list them under SkyKick names.
| Application | Application ID |
|---|---|
| ConnectWise Cloud Backup | 506e08f9-6e9a-4da4-942b-a099a03644ae |
| ConnectWise Cloud Management | 2399d300-6fca-4e6a-a686-399fefe75b83 |
| Cloud Management – MS Teams | 24205314-2b89-4e07-a2a4-579e898a5640 |
| Cloud Management – Exchange Online | b78f6a77-d4e5-46fb-87e5-d1648bd02519 |
| Cloud Management – MS Graph | 0de14c77-b9b0-4137-9360-34878a929827 |
| Cloud Management – Partner Center | 412dcf96-176d-4b3a-a1b0-4981ad66971e |
| Cloud Management – SharePoint Online | b2b55f5b-7758-4719-8d8f-88ae172e6bdb |
How do I check if my Microsoft 365 tenant was affected?
- Immediately disable application 506e08f9-6e9a-4da4-942b-a099a03644ae in the Entra admin center. Keep the apps disabled until ConnectWise confirms that all credentials have been reset. Tokens that were already issued can stay valid for up to 90 minutes after you disable an app.
- Download theopen-source version of AzureHound and run the collector.
- Review your sign-in logs for service principal authentication tied to the application IDs listed above. Pay special attention to activity from the source IP 144.172.64[.]128.
- Revoke unneeded application consents. If you don’t actively use SkyKick or ConnectWise Cloud Backup, remove their application consents from your tenant.
Use Bloodhound to map impact of ConnectWise applications
BloodHound users may run the below cypher queries to identify potential impact to their environments.
_Identify outbound control of ConnectWise application_
MATCH p=shortestPath((sp:AZServicePrincipal)-[*1..6]->(t)) WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’ AND t.system_tags CONTAINS ‘admin_tier_0’ RETURN p
_Identify paths from the impacted service principal to Tier Zero._
MATCH p=shortestPath((sp:AZServicePrincipal)-[*1..6]->(t)) WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’ AND t.system_tags CONTAINS ‘admin_tier_0’
Map your vendor apps before the next breach
This won’t be the last time a trusted vendor’s credential is compromised. Every third-party app with consent in your tenant is a potential attack path, and most organizations can’t easily say which apps hold which permissions. The open source AzureHound gives you that map: every service principal, every permission, and every path from those apps to your most sensitive assets.
Download AzureHound on GitHub →
Stay tuned for additional updates from our threat research as they become available.
Post Views: 8,789
Chief Product Officer
Justin Kohler is Chief Product Officer at SpecterOps, leading BloodHound and other security products. With 15+ years in product and security, he’s led teams at Gigamon, ICEBRG, and Microsoft, and served as a U.S. Air Force cryptologic linguist.
Director of Applied Security Research
Duane (@subat0mik) is Director of Applied Security Research at SpecterOps, specializing in adversary simulation operations and offensive security research. He has over 15 years of experience in information security, across both offense and defense. He has developed research, tooling, and training on various topics, and has presented his work at conferences around the world.
📦 Full-Text Markdown Snapshot archived by Phying News · Original source: specterops.io
--- id: 9941 canonical_url: "https://phying.com/item/9941" title: "ConnectWise SkyKick Breach: How to Check Your Microsoft 365 Tenant" type: "blog" cve: null cvss: null severity: "unknown" vendor: null product: null affected_versions: null source_domain: "specterops.io" source_url: "https://specterops.io/blog/2026/10/17/connectwise-skykick-breach-microsoft-365/" published_at: "2026-10-17T20:41:40Z" snapshot_at: "2026-10-27T14:49:56Z" archived_by: "Phying News (https://phying.com/item/9941)" lang: "en" --- # ConnectWise SkyKick Breach: How to Check Your Microsoft 365 Tenant *Published on: 2026-10-17 · Source: [specterops.io](https://specterops.io/blog/2026/10/17/connectwise-skykick-breach-microsoft-365/)* [ Back to Blog ](https://specterops.io/blog) [Research & Tradecraft](https://specterops.io/blog/category/research/) # ConnectWise SkyKick Breach: How to Check Your Microsoft 365 Tenant Author [Justin Kohler](https://specterops.io/blog/author/justin-kohler/), [Duane Michael](https://specterops.io/blog/author/duanemichael/) Read Time 5 mins Published Oct 17, 2026 ##### Share [ ](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fspecterops.io%2Fblog%2F2026%2F10%2F17%2Fconnectwise-skykick-breach-microsoft-365%2F&title=ConnectWise+SkyKick+Breach%3A+How+to+Check+Your+Microsoft+365+Tenant%C2%A0&source=SpecterOps) [ ](https://twitter.com/share?url=https%3A%2F%2Fspecterops.io%2Fblog%2F2026%2F10%2F17%2Fconnectwise-skykick-breach-microsoft-365%2F&text=ConnectWise+SkyKick+Breach%3A+How+to+Check+Your+Microsoft+365+Tenant%C2%A0) [ ](mailto:?Subject=I%20thought%20you'd%20like%20this%20post:%20ConnectWise SkyKick Breach: How to Check Your Microsoft 365 Tenant &Body=https://specterops.io/blog/2026/10/17/connectwise-skykick-breach-microsoft-365/) [ ](https://specterops.io/blog/category/research/feed/) Put Insights Into Action * [ Explore our Platform ](https://specterops.io/platform/bloodhound-enterprise/) * [ Explore Services ](https://specterops.io/services/) _Last updated October 19, 2026_ _at 16:45 UTC_ An attacker used a compromised credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to sign in to customers’ Microsoft 365 tenants. The credential belongs to the application itself, so the attacker inherited the permissions granted to it. Here’s what’s known so far and what to check in your own tenant. _This blog will be updated and cross-linked as more information becomes available._ ## tl;dr * On October 15, an attacker used the ConnectWise Cloud Backup application’s credential to get Microsoft Graph tokens in customer tenants. * As of October 19, Huntress has identified nearly 1,000 Entra tenants with sign-in activity from the IP address associated with the unauthorized activity (`144.172.64[.]128`), with approximately 300 of those sign-ins succeeding thus far. * Disable the affected ConnectWise applications now, and review every application in your tenant for credentials added since October 13. ## What happened in the ConnectWise SkyKick breach? On October 15, 2026, between 06:13 and 08:34 UTC, the ConnectWise Cloud Backup application signed in to customer tenants from 144.172.64[.]128, a hosting provider address. According to Huntress, which first [broke the news](https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access) of the breach, the attacker moved through tenants a few seconds apart, which points to a script working from a target list. According to [The Hacker News](https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html), Microsoft is calling this an active supply chain attack, with the attackers likely abusing permissions customers had already granted the app, including Directory.ReadWrite.All. As of the publication of this blog, ConnectWise has shut off Cloud Backup application access while it investigates. The company says it has found no evidence that partner backup data was compromised. How the attacker obtained the credential has not been disclosed. ## Why doesn’t MFA stop this attack? MFA doesn’t apply because this is an application sign-in, so no user, device, or MFA prompt is involved. Backup tools need broad access to read and restore data. Anyone holding the app’s credential can reach the same mailboxes, OneDrive and SharePoint files, Teams data, and directory information the backup service can. In one tenant, Huntress also saw a second ConnectWise application grant itself Global Administrator and add new client secrets to two other trusted applications. That gives an attacker a way back in even after the original credential is reset. ## Which known ConnectWise applications are affected? Based on recommendations from Huntress and others, SpecterOps built and is actively running cypher queries (below) for the following known ConnectWise applications. The queries hunt for applications owned by the ConnectWise tenant (ID: 3f9cd7a0-127a-4ed4-bf06-2f830d5616b7). Older tenants may list them under SkyKick names. ant (ID: 3f9cd7a0-127a-4ed4-bf06-2f830d5616b7). Older tenants may list them under SkyKick names. **Application** | **Application ID** ---|--- ConnectWise Cloud Backup | 506e08f9-6e9a-4da4-942b-a099a03644ae ConnectWise Cloud Management | 2399d300-6fca-4e6a-a686-399fefe75b83 Cloud Management – MS Teams | 24205314-2b89-4e07-a2a4-579e898a5640 Cloud Management – Exchange Online | b78f6a77-d4e5-46fb-87e5-d1648bd02519 Cloud Management – MS Graph | 0de14c77-b9b0-4137-9360-34878a929827 Cloud Management – Partner Center | 412dcf96-176d-4b3a-a1b0-4981ad66971e Cloud Management – SharePoint Online | b2b55f5b-7758-4719-8d8f-88ae172e6bdb ## How do I check if my Microsoft 365 tenant was affected? 1. **Immediately disable** application 506e08f9-6e9a-4da4-942b-a099a03644ae in the Entra admin center. Keep the apps disabled until ConnectWise confirms that all credentials have been reset. Tokens that were already issued can stay valid for up to 90 minutes after you disable an app. 2. **Download the** [**open-source version of AzureHound**](https://github.com/SpecterOps/AzureHound) and run the collector. 3. **Review your sign-in logs** for service principal authentication tied to the application IDs listed above. Pay special attention to activity from the source IP 144.172.64[.]128. 4. **Revoke unneeded application consents.** If you don’t actively use SkyKick or ConnectWise Cloud Backup, remove their application consents from your tenant. ## Use Bloodhound to map impact of ConnectWise applications BloodHound users may run the below cypher queries to identify potential impact to their environments. _Identify outbound control of ConnectWise application_ MATCH p=shortestPath((sp:AZServicePrincipal)-[*1..6]->(t)) WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’ AND t.system_tags CONTAINS ‘admin_tier_0’ RETURN p _Identify paths from the impacted service principal to Tier Zero._ MATCH p=shortestPath((sp:AZServicePrincipal)-[*1..6]->(t)) WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’ AND t.system_tags CONTAINS ‘admin_tier_0’ ## Map your vendor apps before the next breach This won’t be the last time a trusted vendor’s credential is compromised. Every third-party app with consent in your tenant is a potential attack path, and most organizations can’t easily say which apps hold which permissions. The open source AzureHound gives you that map: every service principal, every permission, and every path from those apps to your most sensitive assets. [Download AzureHound on GitHub →](https://github.com/SpecterOps/AzureHound) Stay tuned for additional updates from our threat research as they become available. Post Views: 8,789 [ Justin Kohler ](https://specterops.io/blog/author/justin-kohler/) Chief Product Officer Justin Kohler is Chief Product Officer at SpecterOps, leading BloodHound and other security products. With 15+ years in product and security, he’s led teams at Gigamon, ICEBRG, and Microsoft, and served as a U.S. Air Force cryptologic linguist. [ Duane Michael ](https://specterops.io/blog/author/duanemichael/) Director of Applied Security Research Duane ([@subat0mik](https://specterops.enterprise.slack.com/team/U01MGQ1JWCC)) is Director of Applied Security Research at SpecterOps, specializing in adversary simulation operations and offensive security research. He has over 15 years of experience in information security, across both offense and defense. He has developed research, tooling, and training on various topics, and has presented his work at conferences around the world. --- > 📦 **Full-Text Markdown Snapshot** archived by [Phying News](https://phying.com/item/9941) · Original source: [specterops.io](https://specterops.io/blog/2026/10/17/connectwise-skykick-breach-microsoft-365/)