ConnectWise Cloud Backup hit by supply chain attack abusing trusted OAuth app across tenants
cyb3rops · x · 2026-10-19
Microsoft Threat Intelligence is tracking an active supply chain attack in which a threat actor compromised the trusted OAuth app of ConnectWise Cloud Backup (formerly SkyKick Backup), leveraging permissions customers had consented to—including Directory.ReadWrite.All—to obtain access tokens across customer tenants.
On October 15, 2026, Microsoft observed broad successful service principal authentication from IP 144.172.64.128, followed by Microsoft Graph API reconnaissance and attempts to add credentials to the service principal. Observed user agents: Python-urllib/3.12 and python-requests/2.31.
ConnectWise confirmed unauthorized access to application identities in its Cloud Backup environment, initiated incident response and containment, says there's no indication partner backup data was accessed, and is shutting down affected components as a protective measure. IOCs have been published for monitoring.
Related event: ConnectWise Cloud Backup Hit by Supply-Chain Attack via Abused OAuth App(2 posts)→
More from Infra
- vLLM cuts container startup time 14-18% with one uv bytecode flag — vllm_project · 2026-10-19
- Why neoclouds get acquired by outsiders, never by each other — AccBalanced · 2026-10-19
- Jev Router cuts coding agent costs 67-85% by routing tasks to cheap open models — HowDevelop · 2026-10-19
- Baidu's Virtual Head Attention cuts KV cache 4-7x with zero custom kernels — burny_tech · 2026-10-19
- Server memory spot growth slows to +0.6% as storage stocks fall 5-7% in a day — tengyanAI · 2026-10-19
- RTX Spark vs M5 Max: local Qwen 3.8 27B benchmark shows NVIDIA wins on compute — draginol · 2026-10-19