ConnectWise supply chain attack: one OAuth app may expose hundreds of M365 tenants
cyb3rops · x · 2026-10-18
Cyb3rops breaks down Microsoft Threat Intelligence's disclosure of a supply chain attack on the ConnectWise Cloud Backup (formerly SkyKick Backup) OAuth app:
- Attackers abused highly elevated permissions customers had granted (e.g. Directory.ReadWrite.All), letting one compromised app access email, files, and directory data across hundreds of Microsoft 365 tenants
- The actor added extra credentials to service principals as a backdoor, persisting even after the original credentials were revoked
- On October 15, 2026, broad service principal auth was observed from IP 144.172.64[].128, followed by Graph API reconnaissance
- MSP involvement means the blast radius could extend to downstream customers; full scope is still unknown
Microsoft urges defenders to audit service principal sign-ins, app credential changes, and OAuth grants, and published IOCs including the AppId, source IP, and user agents.
More from Infra
- When every ablation you run costs $1M — gordic_aleksa · 2026-10-18
- MiniCPM-V 4.7 hits HF trending: 35B-A3B MoE runs on phones in ~3GB — lmoroney · 2026-10-18
- AI race won't be won by code but by concrete: power plant permits take 7 years — r0ck3t23 · 2026-10-18
- Hot take: inference marketplaces will underdeliver as 8GiB local GPUs reach frontier-grade intelligence — Saul_Loveman · 2026-10-18
- AMD unveils Helion rack design with up to 32,768 Zen 6 cores for agentic AI servers — wkmyrhang · 2026-10-18
- Dev builds a playable game on Surface Pro Ultra using local Qwen 3.8 27B — draginol · 2026-10-18