October 18, 2026 · CertCrack Blog

ConnectWise Supply-Chain Attack: How Hackers Walked Into 160+ Microsoft 365 Tenants

No phishing emails. No stolen passwords. No MFA prompts to bypass. In mid-October 2026, attackers compromised a single credential belonging to ConnectWise — the IT management software used by thousands of managed service providers — and used it to authenticate as the ConnectWise Cloud Backup application itself inside customer Microsoft 365 tenants. From there, they inherited the app's broad, pre-approved permissions over mailboxes, files, chats, and directories.

Security researchers at Huntress confirmed 162 tenants with unauthorized sign-ins as of October 16, with later reporting citing up to 173. Around 1,000 Entra tenants showed sign-in activity from the attacker infrastructure, with over 300 successful authentications — though researchers stress that count reflects authentication attempts, not confirmed compromises, since many tenants didn't have the relevant app installed and access failed there.

Microsoft is tracking it as an active supply-chain attack. On October 17, ConnectWise disabled seven application identities and suspended its Cloud Backup service entirely. As of October 18, the service remains offline with no restoration timeline.

How the attack worked

The compromised credential was a client secret living in ConnectWise's own tenant — as Huntress put it, "nothing a customer did in their environment could have produced it." With it, the attacker used the OAuth 2.0 client-credentials flow to authenticate directly as the backup application and receive Microsoft Graph app-only tokens carrying the app's existing consented permissions.

This is what makes the attack so dangerous, and so instructive:

• No user was involved. App-only sign-ins involve no user, no device, and no MFA prompt. Every control built around human authentication — phishing-resistant MFA, conditional access for users — simply didn't apply.
• Permissions were pre-granted. Because backup and restore legitimately need read *and* write access, the tokens inherited broad rights: mailboxes and attachments, OneDrive and SharePoint files, Teams chats, directory data.
• The credential worked everywhere. One stolen secret was valid against every tenant where the app was consented — the attacker wasn't limited to a single victim.

In one tenant, the attack went further. The Cloud Management app for MS Teams granted itself Global Administrator, then planted new client secrets on two other applications — an MSP management app and Huntress's own app. Whoever creates a client secret sees its value at creation, so the attacker held working credentials for those apps independent of the original stolen credential. That's persistence in the MITRE ATT&CK sense (T1098.001): even after the original credential was revoked, the planted secrets would keep working until someone found and removed them.

There's also a visibility gap that should worry every Entra admin: Microsoft audit logs record role assignments but carry no source IP for app-only actions, and directory reads via Graph leave no audit trail at all. So even in tenants where "nothing visible was taken," data access cannot be ruled out.

The timeline

• October 13–14: Password spraying against law-firm tenants and scripted OAuth token requests from the attacker IP 144.172.64[.]128.
• October 14: ConnectWise detects the issue through internal monitoring and activates incident response.
• October 15: The main automated wave — the app authenticates across customer tenants in sorted order, seconds apart, from the attacker IP. A second, more targeted wave hits 16 tenants in sensitive sectors (policy, national security, trade, critical minerals); those attempts fail.
• October 16: Huntress publishes its research; Microsoft confirms supply-chain attack activity. ConnectWise publishes its Trust Center advisory.
• October 17, 07:00 UTC: ConnectWise disables seven application identities, revokes certificates, invalidates shared Cloud Backup credentials, and suspends Cloud Backup. SaaS Security and Cloud Management are also taken offline as a precaution.
• October 18: Cloud Backup remains suspended. ConnectWise says existing archives are encrypted and isolated with no evidence of access — but also cautions that disabling the apps "does not reverse changes previously made inside a tenant" and that previously issued tokens may remain usable until they expire.

How the credential was stolen remains unknown. ConnectWise says it's "unclear if a product vulnerability contributed" — no CVE, no named threat actor, investigation ongoing.

What IT teams must do

Huntress and ConnectWise published detailed guidance. The essentials:

1. Review every managed tenant, including dormant SkyKick connections (Cloud Backup was formerly SkyKick — older tenants may show that name). Check service principal sign-ins in Entra from October 13 onward, filtering for the ConnectWise app IDs and the attacker IP.
2. Disable — don't delete — affected apps in Entra Enterprise applications. Deleting removes the consent records you'll need to restore service later.
3. Audit client secrets and certificates on ALL enterprise apps and app registrations — not just ConnectWise's — for anything added since October 13. Remove anything unexpected. This is the persistence check.
4. Check directory roles and consent grants. Remove any role an app granted itself, especially Global Administrator.
5. Check mailbox forwarding rules, inbox rules, and delegated access.
6. Preserve your sign-in and audit logs before starting containment.

Longer term: restrict who can create client secrets, cap secret lifetimes with app management policies, limit Application Administrator roles, and consider Conditional Access for workload identities.

Why this matters for IT learners

This attack is a masterclass in the concepts behind modern identity security — and it's exactly the kind of scenario that shows up on Security+, AZ-500, SC-300, and CISSP exams:

• Supply-chain attacks don't target you; they target someone you trust. Your security is only as strong as your vendors' credential hygiene.
• Workload identities are the new frontier. Service principals and app registrations now hold the keys to the kingdom, but most teams monitor them far less than user accounts.
• "Assume breach" isn't a slogan. The tenants that fared best were the ones with logging good enough to scope the damage — sign-in logs, audit logs, preserved before containment.

If you're studying for a Microsoft or security certification, learn the shape of this attack: OAuth client-credentials flow, app-only tokens, consent grants, service principals, and why MFA doesn't cover any of it. Then go check your own tenant's enterprise apps. You might be surprised what's consented in there.

Sources

• Huntress: Vendor credential enables unauthorized access
• The Hacker News: ConnectWise suspends Cloud Backup after attackers compromise Microsoft 365 tenants
• The Hacker News: Hackers use compromised ConnectWise credential to sign in to 173 Microsoft 365 tenants
• BleepingComputer: Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
• The Daily Tech Feed: ConnectWise shuts down Cloud Backup after Microsoft 365 credential breach