Huntress has confirmed unauthorized sign-ins across 173 partner and customer Microsoft 365 tenants using a compromised credential belonging to ConnectWise Cloud Backup, the backup service formerly sold as SkyKick. The sign-ins came from a single IP address, 144.172.64[.]128, on October 15, 2026, between 06:13 and 08:34 UTC. Original reporting for this article comes from The Hacker News.

The attacker did not break into each tenant individually. ConnectWise Cloud Backup is an application that MSPs consent into their clients' environments, and that consent grants broad access to mailboxes, OneDrive, SharePoint, Teams, and directory data. Whoever holds the application's credential inherits that access in every tenant where the app is installed.

"The app's credential is in hostile hands," security researcher Jonathan Semon said. The actor "moved through tenants in sorted GUID order, a few seconds apart, which points to a script working from a target list."

If your Microsoft 365 administration is delivered by an MSP, or your own IT team runs ConnectWise Cloud Backup against your tenant, you fall inside the affected population. Microsoft is tracking this as an active supply chain attack against the application's OAuth identity (AppId 506e08f9-6e9a-4da4-942b-a099a03644ae) and says the actor likely abused previously granted permissions including Directory.ReadWrite.All. Follow-on activity included Microsoft Graph API reconnaissance and attempts to add new credentials to the service principal, which would give the attacker a separate way back in.

Attribution is still open. Huntress describes the operators as unknown threat actors, and ConnectWise has confirmed unauthorized access to application identities while its investigation continues. The threat cluster UNC7017, along with the CROSSROAD downloader and SHINYROAD backdoor, belongs to a separate Mandiant investigation into tampering of AOMEI Backupper update infrastructure between April and July 2026. The two cases are not linked in the published research.

What follows covers the token mechanics, the privilege escalation found in at least one partner tenant, and what the exposure means for client data.

From Stolen Credential to Tenant Access: The UNC7017 Intrusion Chain

The intrusion needed no exploit. The actor authenticated to Microsoft Graph directly as the ConnectWise Cloud Backup service principal (AppId 506e08f9-6e9a-4da4-942b-a099a03644ae) using its own tooling, in a manner Huntress described as analogous to how the backup service itself works. The tokens it received carried whatever consent each tenant had already granted, which Microsoft says included highly privileged permissions such as Directory.ReadWrite.All.

That maps to MITRE ATT&CK T1550.001, Application Access Token abuse. The practical consequence for an MSP is that the activity appears as machine-to-machine authentication, recorded under service principal sign-ins rather than user sign-ins, so it does not involve a password, an MFA prompt, or an interactive logon anywhere in your client estate.

The sequencing gives away the automation. The actor moved through tenants in sorted GUID order a few seconds apart, which Huntress reads as a script working from a target list. Todyl's analysis of the inherited consent describes the resulting reach: read/write access to mail and attachments through full Exchange Web Services mailbox access, OneDrive and SharePoint files, and Teams chats, including the ability to restore data.

Token lifetime matters for incident scoping. Revoking user sessions does not terminate this access, and tokens already issued stay valid for up to 90 minutes after an app is disabled in a tenant. Investigators therefore work with a rolling window of valid access that persists past the usual containment reflexes.

Follow-on activity moved toward persistence independent of the stolen credential. Microsoft observed Graph API reconnaissance and attempts to add additional credentials to the related service principal in target tenants, a backdoor technique tracked as T1098.001 (Additional Cloud Credentials). In at least one partner tenant, Huntress found the ConnectWise Cloud Management app for Microsoft Teams (application ID 24205314-2b89-4e07-a2a4-579e898a5640) adding itself to the Global Administrator role, then running a script identified by the user agent Python-urllib/3.12 that wrote new client secrets into two other applications: an MSP management application and Huntress's own Huntress Security Platform app.

Both of those recipients are privileged tools consented into downstream customer tenants, so a secret planted on an MSP management application extends reach past the tenant where it was added. A secret on a security platform's app grants the holder whatever that platform is permitted to do.

Two earlier artifacts matter here. The same source address conducted password spraying (T1110.003) against four law firm tenants on October 13 and 14, 2026, with no successful user sign-ins in Huntress telemetry. And directory reads performed through Microsoft Graph leave no audit trail, which is why Huntress advises treating exposure as likely instead of waiting for proof of access.

Running in parallel, Mandiant, Google Threat Intelligence Group, and ManageEngine Threat Analysis Lab documented a separate chain attributed to UNC7017, which tampered with AOMEI Backupper update infrastructure between April and July 2026. Each tampering window on the origin servers lasted only five to ten minutes before reverting to authentic versions, redirecting the updater to a malicious ZIP from attacker-controlled servers. Inside sits CROSSROAD, a downloader that validates the environment and stages follow-on payloads, establishing scheduled task persistence to deliver SHINYROAD, a modular backdoor framework for covert command and control loaded through DLL sideloading. Affected organizations span IT services, telecommunications, and higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the U.S.

Indicators for the Microsoft 365 activity are published in the Huntress and Todyl write-ups, Microsoft's post on X, and ConnectWise's advisory. The AOMEI indicators appear in the Google and ManageEngine research.

What Breach of a Managed Service Provider Credential Means for Tenants

In plain terms, that is your contracts, your payroll and HR files, your board material, your legal correspondence, and the private channel conversations your staff assume no one else reads.

The most immediate financial risk from that level of mailbox access is payment fraud. An attacker reading your finance mailbox learns who approves invoices, what your invoice templates look like, which suppliers you pay by bank transfer, and how your team words a change of bank details. Write access to mail means messages can be placed into the environment, not merely read, which is how a fraudulent payment request ends up inside a thread your accounts team already trusts.

If you are a customer of an affected MSP, your own controls were not the failure point. Multi-factor authentication, conditional access, and password policy govern user sign-ins. This was application authentication using a credential your provider held on your behalf. Huntress noted the same source address ran password spraying against four law firm tenants on October 13 and 14, 2026 with no successful user sign-ins in its telemetry, while the application route worked.

Your exposure may also extend past the backup app. In one partner tenant, a ConnectWise Cloud Management app for Microsoft Teams added itself to the Global Administrator role and then ran a Python script that wrote new client secrets into two other applications: an MSP management tool and a security platform. As Huntress put it, a credential on a security tool's application gives the holder whatever that tool is permitted to do. If your provider's management application is consented into its whole client base, a secret added there reaches further than your tenant.

The compliance problem is that you may not be able to prove what was taken. Directory reads through Microsoft Graph leave no audit trail, so the absence of a log entry is not evidence of absence of access. Your counsel will have to assess notification duties under GDPR or UK GDPR, HIPAA if you hold protected health information, or SEC materiality disclosure if you are a public filer, on the basis of what the token made possible. Regulators generally expect you to start that clock from the point you learn your data was accessible, and a law firm, clinic, or listed company will be held to that standard regardless of who held the credential.

Contractually, now is the point to read your MSP agreement rather than assume. Check who carries the notification obligation to your clients and data subjects, whether the provider is named as a processor, what indemnity applies to a vendor-side credential compromise, and whether you have audit rights over the applications consented into your tenant. Many MSP contracts were written around service availability and say little about who pays for forensics and client notification after a vendor account is breached.

There is a direct operational cost too. ConnectWise closed Cloud Backup application access while its investigation continues, so for the duration your Microsoft 365 backup and restore capability is unavailable. On top of that, credential rotation, token review, and secret audits have to be completed across every affected tenant, work that falls on the same provider staff who also handle your day-to-day support queue.

Hunting for UNC7017 Activity in Microsoft 365 Sign-In and Audit Logs

Start in the Entra admin center. Open Monitoring → Sign-in logs and select the Service principal sign-ins tab, then filter on the Cloud Backup application ID published in ConnectWise's advisory. The default User sign-ins tab will not surface this activity at all, which is why a tenant can look clean on a casual check while token-based access is sitting in the service principal records.

Judge what you find by source address. ConnectWise has stated the application's normal egress is Azure private IPv6, so any authentication for that app from an IPv4 address outside Microsoft and Azure ranges should be treated as unauthorized until proven otherwise, including the single address named in the advisory.

Disabling the application in your tenant stops new tokens from being issued there, but it does not invalidate tokens already minted, and revoking user sessions has no effect on application-level access. Plan for a short window after you disable where the existing token still works, and keep watching Graph activity during it.

Your audit hunt should cover everything back to October 13, 2026. In the Entra audit logs, look for:

• New client secrets or certificates added to any service principal, not only the backup app
• Any ConnectWise or SkyKick application adding itself to a directory role, Global Administrator in particular
• The Python-urllib/3.12 user agent appearing against directory or application write operations
• New or modified OAuth consent grants, especially ones issued without a corresponding admin ticket
• Inbox rules and mail forwarding created on finance, executive, and conveyancing mailboxes

Enable Microsoft Graph activity logs if you have not already. Directory reads through Graph leave no entry in the standard audit trail, so without Graph activity logging you have no record of what the token read, only of when it signed in. That gap matters when a client asks you to state exactly which records were touched.

The same source address ran password spraying against four law firm tenants on October 13 and 14, 2026, with no successful sign-ins observed in Huntress telemetry. Check your own interactive sign-in failures across those dates for admin and partner accounts, then enforce phishing-resistant MFA (FIDO2 keys or Windows Hello for Business) on every administrative and delegated-access account you hold.

Over the next two weeks, review your GDAP relationships and cut each one to the narrowest role that still lets your engineers work. Confirm Unified Audit Log is enabled with retention that outlasts a typical investigation, and set conditional access so administrative sign-ins only succeed from compliant devices in expected locations. Where client contracts allow, write log retention and access-review obligations into the agreement so you are not negotiating for evidence mid-incident.

Separately, if any managed endpoint runs AOMEI Backupper, hunt for CROSSROAD and SHINYROAD artifacts on hosts that pulled updates between April and July 2026. Mandiant attributes that tampering to UNC7017 and describes scheduled task persistence paired with DLL sideloading, so review scheduled tasks created by the updater process and unsigned DLLs loaded from application directories.

In environments Capstone manages, Adlumin monitors Entra sign-in and audit telemetry for exactly this pattern, service principal authentication from unexpected addresses and new credentials appearing on privileged applications. Run the service principal query first, then work the audit log back to October 13.

Priorities for Organizations Relying on Outsourced Microsoft 365 Administration

The defining feature of this incident is that nothing was broken into. A valid credential held by a third party sits outside the controls most organizations rely on, so conditional access rules, MFA enforcement, and IP restrictions tuned for user logins never came into play. Detection in cases like this happens in identity telemetry or it does not happen at all.

If you outsource Microsoft 365 administration, your exposure is set by the list of applications your provider has consented into your tenant and the permissions attached to each one. Most firms have never seen that list. It typically includes backup, RMM, security tooling, documentation platforms, and migration utilities, each carrying consent granted years ago by someone who has since changed roles.

Backup and recovery products carry unusual weight in that inventory. They need wide read access by design, and their update channels reach every installation. Google's Mandiant documented a separate case between April and July 2026 in which an actor repeatedly tampered with AOMEI Backupper's update configuration in windows lasting five to ten minutes each, delivering the CROSSROAD downloader and the SHINYROAD backdoor to organizations across IT services, telecommunications, and higher education in countries including Australia, Brazil, India, Portugal, Singapore, and the United States.

The practical consequence for your business is contractual as much as technical. You cannot rotate a credential you do not hold, and your recovery timeline depends on a vendor's response.

The single most important action is to audit your Microsoft 365 sign-in records against the indicators published in ConnectWise's advisory, and to revoke any partner or RMM application credential you cannot positively account for.