Managed service providers and their downstream customers were the primary targets of the automated scripts launched from the 144.172.64.128 infrastructure on October 14, 2026. This sophisticated supply-chain attack exploited the trust inherent in the ConnectWise Cloud Backup ecosystem, specifically targeting application identities formerly associated with the SkyKick brand. By gaining unauthorized access to these service principals, threat actors managed to infiltrate at least 162 Microsoft 365 tenants, leveraging the extensive permissions granted to the backup service. The breach was particularly effective because it bypassed multi-factor authentication entirely, as the attackers used stolen application credentials rather than individual user logins. This allowed them to act with the authority of the application itself, viewing emails, accessing files, and modifying directory data without triggering traditional security alerts. Security researchers confirmed that the intrusion relied on the abuse of valid service principals rather than malware.
The technical core of this incident involved the compromise of a specific client secret belonging to the ConnectWise Cloud Backup application. This credential served as a master key, allowing the attackers to authenticate directly as a service principal within customer Microsoft 365 environments. Once authenticated, the automated scripts utilized the Microsoft Graph API to perform reconnaissance and execute commands across various services. Evidence gathered from audit logs shows that the actors employed a range of user agents, including python-urllib/3.12 and curl/7.88.1, to facilitate rapid, scripted interactions with the cloud infrastructure. This automated approach allowed the threat actors to traverse multiple customer tenants in a matter of hours, enumerating directory information and identifying high-value targets for further exploitation. Because the application already possessed broad permissions such as Directory.ReadWrite.All, the attackers did not need to perform complex exploits to gain full control.
1. Technical Analysis: Unveiling the Credential Exploitation
Beyond initial access, the attackers engaged in aggressive privilege escalation and persistence techniques within several high-profile tenants. By utilizing the elevated permissions inherent in the service principal, the actors assigned critical directory roles, such as Global Administrator and Exchange Administrator, to their own controlled identities or other trusted applications. This maneuver ensured that the intrusion would persist even if the original compromised application credential was revoked or reset by the vendor. In some instances, the attackers added their own client secrets and certificates to existing, legitimate applications within the tenant, creating hidden backdoors for future access. These tactics align with various MITRE ATT&CK techniques, specifically Valid Accounts for Cloud, Supply Chain Compromise, and Account Manipulation. This methodical approach to maintaining a foothold suggests a high degree of operational planning aimed at long-term data access.
The automated nature of the scripts used in the infrastructure attack indicates a high level of technical proficiency and scale. By targeting the Graph API, the threat actors were able to bypass the web-based administrative interfaces that might have triggered more immediate visual alerts for administrators. Instead, the scripts quietly queried the directory for user lists, group memberships, and administrative roles, allowing the actors to map the internal structure of each victim organization with surgical precision. This reconnaissance phase was critical for identifying which accounts to target for privilege escalation and which mailboxes contained the most sensitive information. The use of multiple Python-based user agents further suggests that the attackers were rotating through different script versions to avoid detection by simple signature-based security tools. This highlight the need for behavior-based monitoring that can detect anomalous API traffic.
2. Software Impact: Mapping the Compromised Infrastructure
The scope of the attack was defined by a specific set of application identifiers that organizations must now identify and secure within their environments. The primary application ID targeted was 506e08f9-6e9a-4da4-942b-a099a03644ae, which corresponds to the main Cloud Backup service. However, the compromise extended to related management and integration tools, including identities for Microsoft Teams, Exchange Online, and the Partner Center. Specifically, applications with IDs such as 2399d300-6fca-4e6a-a686-399fefe75b83 and b2b55f5b-7758-4719-8d8f-88ae172e6bdb were also identified as vectors for unauthorized activity. These applications were designed to provide seamless administrative access for managed service providers, making them ideal targets for a supply-chain disruption. The sheer breadth of these integrations meant that any organization using the ConnectWise suite for Microsoft 365 management was potentially exposed to the automated scripts.
A clear timeline of the event illustrates the speed at which the threat actors moved from initial probing to widespread exploitation. Significant scripted sign-in activity was first detected between October 13 and October 14, 2026, originating from a single IP infrastructure. By the morning of October 15, the attackers had begun actively accessing customer environments, using the compromised credentials to harvest data and escalate their presence. ConnectWise identified the breach on October 14 and initiated a comprehensive incident response plan, which eventually led to the suspension of the affected services. On October 17, the vendor took the decisive step of deactivating the compromised application identities across the entire ecosystem to prevent further unauthorized access. While the service remains offline as of October 18, forensic teams continue to analyze the telemetry to determine if any sensitive backup archives were exfiltrated during the window of opportunity for the hackers.
3. Critical Responses: Deactivation and Audit Protocols
Mitigating the impact of this supply-chain attack requires a structured and immediate response from all affected administrators. The first priority is to manually disable the compromised ConnectWise and SkyKick applications within the Microsoft Entra admin center. It is not enough to rely on the vendor’s central deactivation, as existing tokens or local configurations might still pose a risk. Administrators must navigate to the enterprise applications section and ensure that the IDs listed in the technical advisories are set to prevent further sign-ins. These applications should remain in a disabled state until the vendor provides explicit confirmation that all associated credentials, including secrets and certificates, have been fully rotated and verified. This proactive step stops the immediate threat of new sessions being established. However, organizations must remember that disabling an application does not automatically revoke existing tokens that have already been issued to the attacker.
Following the deactivation of the applications, the next critical step is a thorough audit of all application credentials and secrets within the environment. Security teams should scan for any new client secrets, certificates, or federation settings that were added after the initial detection date of October 13, 2026. Attackers often add their own credentials to trusted applications to maintain a foothold that survives the initial cleanup process. Any unrecognized or unauthorized additions must be removed immediately, and unnecessary application consents should be revoked. This is especially important for legacy SkyKick integrations or dormant ConnectWise tools that may have been overlooked during previous security reviews. By hardening the application consent model and removing excessive permissions, administrators can reduce the attack surface and prevent the threat actor from pivoting back into the system through a secondary, less-monitored application identity.
4. Forensic Investigation: Log Analysis and Identity Verification
Forensic log analysis is essential for identifying whether a specific tenant was actually breached during the incident window. Administrators should scrutinize the sign-in logs for any service principal authentication events tied to the affected application IDs, focusing specifically on activity originating from the IP address 144.172.64.128. The presence of this IP in the logs is a strong indicator of compromise, as is the use of non-standard user agents like python-requests or curl. Furthermore, audit logs should be examined for any Directory.ReadWrite.All activity that occurred outside of normal maintenance windows or originated from unexpected geographic locations. Preserving these logs is vital for potential legal or insurance requirements, as well as for understanding the full extent of the data access. If suspicious activity is found, the scope of the investigation must expand to include all actions taken by the service principal, including file downloads and directory changes.
Beyond simple authentication checks, organizations must verify the integrity of their directory roles and data routing rules. The threat actors were observed assigning themselves high-level roles like Global Administrator, so a review of all administrative assignments made since mid-October is mandatory. Any changes to directory ownership or security policies must be validated against known internal change requests. Additionally, security teams should inspect Exchange Online settings for unauthorized mailbox forwarding rules, transport modifications, or changes to delegated access. These maneuvers are common ways for attackers to exfiltrate sensitive data or monitor internal communications even after their primary access method has been severed. Checking for new inbox rules that move emails to the RSS Feeds or Junk folders can also reveal attempts to hide evidence of unauthorized access. A comprehensive sweep of these settings ensures that no residual backdoors remain in the environment.
5. Operational Resilience: Navigating Post-Incident Recovery
The ConnectWise supply-chain incident served as a stark reminder of the risks associated with broad third-party application permissions. To prevent similar compromises, organizations moved toward a model of least-privileged access for all cloud integrations, ensuring that service principals only held the specific permissions required for their tasks. Many administrators implemented automated monitoring for service principal activity, setting alerts for any sign-ins from unusual IP addresses or changes to sensitive directory roles. These proactive measures provided the visibility needed to detect the automated scripts before they could cause widespread damage. Moving forward, the focus shifted from simple vendor trust to continuous validation of the security posture of all connected services. By maintaining detailed audit trails and strictly controlling application consents, businesses successfully mitigated the long-term impact of the breach and hardened their defenses.
Continuous assessment of third-party risk became a cornerstone of the recovery strategy following the restoration of services. Organizations prioritized the implementation of conditional access policies specifically tailored for service principals, a move that significantly restricted the environments from which these applications could authenticate. By limiting access to known, trusted IP ranges and requiring compliant devices for any administrative changes, security teams created a multi-layered defense that effectively neutralized the threat of stolen client secrets. Additionally, the adoption of periodic credential rotation and the transition toward certificate-based authentication further reduced the likelihood of a successful replay attack. These technical adjustments, combined with a more rigorous vendor vetting process, allowed businesses to regain confidence in their cloud-based backup and management tools. The lessons learned from the breach fundamentally changed how managed services were integrated.
