Update, October 22, 2026: This article originally named UNC7017 in its headline, summary and two section headings, and its summary listed that case's CROSSROAD and SHINYROAD malware as tooling in this activity. Both were wrong. UNC7017 is the name Google Threat Intelligence Group and Mandiant use for the threat cluster behind a separate case, the tampering of AOMEI Backupper's update servers covered below, and none of the published research we reviewed links it to this compromise. On October 21, Microsoft said it assesses that Storm-0940, which it describes as a China state-aligned actor active since 2021, was responsible, and ConnectWise now says it appears a China state-aligned group was behind it. Microsoft says the group used an AI penetration testing framework called ARTEX to attempt sign-ins to more than 2,250 tenants. The count of 173 tenants below is the figure Huntress gave late on October 16. On October 17 Huntress reported sign-in activity from the same address, 144.172.64[.]128, in almost 1,000 tenants, more than 300 of them successful, though not every successful sign-in gained access. We also corrected how this article credited Huntress's advice, where the credential lived (ConnectWise's own tenant, not your provider's) and the ATT&CK technique for the sign-ins, and updated the hunting guidance below to match the vendors' current advice. Later that day we removed a sign-in rate this note had paired with the 2,250 tenants, because Microsoft's own breakdown ties that figure to a separate password spray in which it saw no successful sign-ins, added that Huntress found the same privilege escalation in a second tenant, and dated two Microsoft statements.

Huntress has confirmed unauthorized sign-ins across 173 partner and customer Microsoft 365 tenants using a compromised credential belonging to ConnectWise Cloud Backup, the backup service formerly sold as SkyKick. The sign-ins came from a single IP address, 144.172.64[.]128, on October 15, 2026, between 06:13 and 08:44 UTC. Original reporting for this article comes from The Hacker News.

The attacker did not break into each tenant individually. ConnectWise Cloud Backup is an application that MSPs consent into their clients' environments, and that consent grants broad access to mailboxes, OneDrive, SharePoint, Teams, and directory data. Whoever holds the application's credential inherits that access in every tenant where the app is installed.

"The app's credential is in hostile hands," security researcher Jonathan Semon said. The actor "moved through tenants in sorted GUID order, a few seconds apart, which points to a script working from a target list."

If ConnectWise Cloud Backup is connected to your tenant, whether your MSP set it up or your own IT team runs it, you are in the population ConnectWise says to review, even if the connection is dormant. On October 17 Microsoft said it was tracking this as an active supply chain attack against the application's OAuth identity (AppId 506e08f9-6e9a-4da4-942b-a099a03644ae) and that the actor likely abused previously granted permissions including Directory.ReadWrite.All. Follow-on activity included Microsoft Graph API reconnaissance and attempts to add new credentials to the service principal, which would give the attacker a separate way back in.

Microsoft assesses that Storm-0940, which it describes as a China state-aligned actor active since 2021, was responsible, and ConnectWise says it appears a China state-aligned group was behind the attack. Huntress, which confirmed the sign-ins, has not named an actor. The threat cluster UNC7017, along with the CROSSROAD downloader and SHINYROAD backdoor, belongs to a separate investigation by Google Threat Intelligence Group and Mandiant into tampering of AOMEI Backupper update infrastructure between April and July 2026. None of the published research we reviewed links the two cases.

What follows covers the token mechanics, the privilege escalation Huntress found in two tenants, and what the exposure means for client data.

From Stolen Credential to Tenant Access: The Intrusion Chain

Once the attacker held the credential, getting into client tenants needed no exploit. The actor authenticated to Microsoft Graph directly as the ConnectWise Cloud Backup service principal (AppId 506e08f9-6e9a-4da4-942b-a099a03644ae) using its own tooling, in a manner Huntress described as analogous to how the backup service itself works. The tokens it received carried whatever consent each tenant had already granted, which Microsoft said on October 17 included highly privileged permissions such as Directory.ReadWrite.All.

Microsoft and Huntress map this step to MITRE ATT&CK T1078.004, Valid Accounts: Cloud Accounts. The practical consequence for an MSP is that the activity appears as machine-to-machine authentication, recorded under service principal sign-ins rather than user sign-ins, so it does not involve a password, an MFA prompt, or an interactive logon anywhere in your client estate.

The sequencing gives away the automation. The actor moved through tenants in sorted GUID order a few seconds apart, which Huntress reads as a script working from a target list. Todyl's analysis of the inherited consent describes the resulting reach: read/write access to mail and attachments through full Exchange Web Services mailbox access, OneDrive and SharePoint files, and Teams chats, including the ability to restore data.

Token lifetime matters for incident scoping. Revoking user sessions does not terminate this access, and tokens already issued stay valid for up to 90 minutes after an app is disabled in a tenant. Investigators therefore work with a rolling window of valid access that persists past the usual containment reflexes.

Follow-on activity moved toward persistence independent of the stolen credential. Microsoft observed Graph API reconnaissance and attempts to add additional credentials to the related service principal in target tenants, a backdoor technique tracked as T1098.001 (Additional Cloud Credentials). On October 21 Microsoft added that in some environments the attacker went further, modifying application credentials to establish persistence and making changes involving identities, groups and privileged roles. On October 15 around 03:45 UTC, before the first sign-ins from 144.172.64[.]128, Huntress found in one partner tenant the ConnectWise Cloud Management app for Microsoft Teams (application ID 24205314-2b89-4e07-a2a4-579e898a5640) adding itself to the Global Administrator role, then running a script identified by the user agent Python-urllib/3.12 that wrote new client secrets into two other applications: an MSP management application and Huntress's own Huntress Security Platform app. Huntress later found the same procedure in a second tenant, where a ConnectWise app again granted itself Global Administrator and then planted new secrets on a few other applications. In both tenants it found no evidence of mailbox or file manipulation, or of user or policy changes.

Huntress notes that a credential added to an MSP management application can extend access beyond that tenant, because those applications are often consented into the MSP's customers' tenants, though it says it has not seen that happen. The Huntress app that received a secret was single-tenant, unique to that partner, and a credential on a security tool's app gives the holder whatever that tool is permitted to do.

Two earlier artifacts matter here. The same source address conducted password spraying (T1110.003) against four law firm tenants on October 13 and 14, 2026, with no successful user sign-ins in Huntress telemetry. And Huntress notes that directory reads performed through Microsoft Graph leave no audit trail, which is why it suggests acting now instead of waiting for proof of access.

Separately, Mandiant, Google Threat Intelligence Group, and ManageEngine Threat Analysis Lab documented a different supply chain case attributed to UNC7017, which tampered with AOMEI Backupper update infrastructure between April and July 2026. Each tampering window on the origin servers lasted only five to ten minutes before reverting to authentic versions, redirecting the updater to a malicious ZIP from attacker-controlled servers. Inside sits CROSSROAD, a downloader that validates the environment and stages follow-on payloads, establishing scheduled task persistence to deliver SHINYROAD, a modular backdoor framework for covert command and control loaded through DLL sideloading. Affected organizations span IT services, telecommunications, and higher education across Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye, and the U.S.

Indicators for the Microsoft 365 activity are published in the Huntress and Todyl write-ups, Microsoft's October 21 research post, and ConnectWise's advisory. The AOMEI indicators appear in the Google and ManageEngine research.

What a Compromised Backup Vendor Credential Means for Tenants

In plain terms, that is your contracts, your payroll and HR files, your board material, your legal correspondence, and the private channel conversations your staff assume no one else reads.

The most immediate financial risk from that level of mailbox access is payment fraud. An attacker reading your finance mailbox learns who approves invoices, what your invoice templates look like, which suppliers you pay by wire or ACH, and how your team words a change in bank account information. Write access to mail means messages can be placed into the environment, not merely read, which is how a fraudulent payment request ends up inside a thread your accounts payable team already trusts.

If you are a customer of an affected MSP, your own controls were not the failure point. Multi-factor authentication, conditional access, and password policy govern user sign-ins. This was application authentication using the backup vendor's own credential, which lived in ConnectWise's tenant. As Huntress put it, nothing a customer did in their environment could have produced it. Huntress noted the same source address ran password spraying against four law firm tenants on October 13 and 14, 2026 with no successful user sign-ins in its telemetry, while the application route worked.

Your exposure may also extend past the backup app. In two tenants Huntress reviewed, a ConnectWise app added itself to the Global Administrator role and then planted new client secrets on other applications. In the first, a Python script wrote them into an MSP management tool and a security platform. As Huntress put it, a credential on a security tool's application gives the holder whatever that tool is permitted to do. If your provider's management application is consented into its whole client base, a secret added there can reach further than your tenant.

The compliance problem is that you may not be able to prove what was taken. Directory reads through Microsoft Graph leave no entry in the standard audit trail, so a quiet directory log is not evidence that nothing was read. Your counsel will have to assess notification duties under GDPR or UK GDPR, HIPAA if you hold protected health information, or SEC materiality disclosure if you are a public filer, on the basis of what the token made possible. Under HIPAA, for example, the clock starts on the day a breach is known, or would have been known with reasonable diligence, not on the day you can prove what was taken, and a law firm, clinic, or public company can be held to that standard regardless of who held the credential.

Contractually, now is the point to read your MSP agreement rather than assume. Check who carries the notification obligation to your clients and data subjects, whether the provider is named as a processor, what indemnity applies to a vendor-side credential compromise, and whether you have audit rights over the applications consented into your tenant. Many MSP contracts were written around service availability and say little about who pays for forensics and client notification after a vendor account is breached.

There is a direct operational cost too. ConnectWise suspended Cloud Backup on October 17 and began restoring services in phases on October 21, a process it expects to take several days, so until your service is restored your Microsoft 365 backup and restore capability may be unavailable. On top of that, credential rotation, token review, and secret audits have to be completed across every affected tenant, work that falls on the same provider staff who also handle your day-to-day support queue.

Hunting for Cloud Backup Credential Abuse in Microsoft 365 Sign-In and Audit Logs

Start in the Entra admin center. Open Monitoring → Sign-in logs and select the Service principal sign-ins tab, then filter on the ConnectWise application IDs published in ConnectWise's advisory, which lists seven app identities, not only Cloud Backup's. The default User sign-ins tab will not surface this activity at all, which is why a tenant can look clean on a casual check while token-based access is sitting in the service principal records.

Judge what you find by source address, but do not stop there. ConnectWise has said the application's normal egress is Azure private IPv6, so any authentication for these apps from an IPv4 address outside Microsoft and Azure ranges deserves scrutiny, starting with the addresses listed in the advisory. ConnectWise now also warns against limiting the search to the published addresses or assuming a Microsoft or private address means legitimate use, and Huntress found that the access behind one tenant's new secrets came from private Azure IPv6 space.

Disabling the application in your tenant stops new tokens from being issued there, but it does not invalidate tokens already minted, and revoking user sessions has no effect on application-level access. Plan for a short window after you disable where the existing token still works, and keep watching Graph activity during it.

Your audit hunt should cover everything back to October 13, 2026, and sign-in records back to October 1 where they exist, as Microsoft and ConnectWise now advise. Entra normally keeps sign-in and audit records for seven days on the free tier and 30 days with P1 or P2, ConnectWise notes, so on a free-tier tenant the October 15 records may already be gone unless they were exported or sent to a SIEM. In the Entra audit logs, and in the Microsoft Purview audit log for mailbox changes, look for:

• New client secrets or certificates added to any service principal, not only the backup app
• Any ConnectWise or SkyKick application adding itself to a directory role, Global Administrator in particular
• The Python-urllib/3.12 user agent appearing against directory or application write operations
• New or modified OAuth consent grants, especially ones issued without a corresponding admin ticket
• Inbox rules and mail forwarding created on finance, executive, and real estate closing mailboxes

Enable Microsoft Graph activity logs if you have not already. They need Entra ID P1 or P2, they record only from the day they are turned on, and they capture directory reads through Graph, which leave no entry in the standard audit trail. Mail and file reads are different. Where auditing is on and licensed, the Microsoft 365 audit log records those reads and names the calling app, and Todyl advises searching it for read events by this app's ID. Those records show Microsoft's own addresses rather than the attacker's, so Todyl could not tell the attacker's reads from the backup service's own. Microsoft 365 Business plans do not turn auditing on by default, so check whether it was on in mid-October and export whatever records exist before retention runs out. They are what you will need when a client asks which of their records were touched.

The address behind the October 15 sign-ins, 144.172.64[.]128, also ran password spraying against four law firm tenants on October 13 and 14, 2026, with no successful sign-ins observed in Huntress telemetry. Check your own interactive sign-in failures across those dates for admin and partner accounts, then enforce phishing-resistant MFA (FIDO2 keys or Windows Hello for Business) on every administrative and delegated-access account you hold.

Over the next two weeks, review your GDAP relationships and cut each one to the narrowest role that still lets your engineers work. Confirm Unified Audit Log is enabled with retention that outlasts a typical investigation, and set conditional access so administrative sign-ins only succeed from compliant devices in expected locations. Where client contracts allow, write log retention and access-review obligations into the agreement so you are not negotiating for evidence mid-incident.

Separately, if any managed endpoint runs AOMEI Backupper, hunt for CROSSROAD and SHINYROAD artifacts on hosts that pulled updates between April and July 2026. Mandiant attributes that tampering to UNC7017 and describes scheduled task persistence paired with DLL sideloading, so review scheduled tasks created by the updater process and unsigned DLLs loaded from application directories.

Run the service principal query first, then work the audit log back to October 13.

Priorities for Organizations Relying on Outsourced Microsoft 365 Administration

The defining feature of this incident is that the attacker needed no exploit to get into the client tenants. It signed in with an app credential those tenants already trusted. A valid credential held by a third party sits outside the controls most organizations rely on, so conditional access rules, MFA enforcement, and IP restrictions tuned for user logins never came into play. Detection in cases like this happens in identity telemetry or it does not happen at all.

If you outsource Microsoft 365 administration, your exposure is set by the list of applications your provider has consented into your tenant and the permissions attached to each one. Most firms have never seen that list. It typically includes backup, RMM, security tooling, documentation platforms, and migration utilities, each carrying consent granted years ago by someone who has since changed roles.

Backup and recovery products carry unusual weight in that inventory. They need wide read access by design, and their update channels reach every installation. Google's Mandiant documented a separate case between April and July 2026 in which an actor repeatedly tampered with AOMEI Backupper's update configuration in windows lasting five to ten minutes each, delivering the CROSSROAD downloader and the SHINYROAD backdoor to organizations across IT services, telecommunications, and higher education in countries including Australia, Brazil, India, Portugal, Singapore, and the United States.

The practical consequence for your business is contractual as much as technical. You cannot rotate a credential you do not hold, and your recovery timeline depends on a vendor's response.

The single most important action is to audit your Microsoft 365 sign-in records for the ConnectWise app IDs, treating the indicators in ConnectWise's advisory as a starting point rather than the whole search, and to disable any partner or RMM application you cannot positively account for. Disable rather than delete, as Microsoft and Huntress both advise.