A trusted cybersecurity or backup application can become a serious security risk when its credentials fall into the wrong hands.
A recent incident involving ConnectWise Cloud Backup has highlighted this challenge after attackers reportedly used a compromised vendor credential to gain unauthorized access to 173 Microsoft 365 partner and customer tenants.
The incident demonstrates how attackers can exploit trusted applications and their existing permissions to reach multiple organizations, potentially exposing emails, business documents, collaboration data, and sensitive directory information.
For businesses that depend on cloud services and managed service providers, the lesson is clear: securing employee accounts alone is not enough. Organizations must also protect the applications, service identities, integrations, and third-party providers that operate within their environments.
What Happened in the ConnectWise Incident?
ConnectWise Cloud Backup, formerly known as SkyKick Backup, is a service used by managed service providers to back up and recover data from platforms such as Microsoft 365.
To perform these functions, the application may receive permissions to access services including Exchange mailboxes, OneDrive, SharePoint, Microsoft Teams, and directory information.
According to cybersecurity reporting, an attacker obtained a vendor application credential and used it to authenticate to Microsoft 365 environments where the application had already been authorized.
Researchers reported unauthorized sign-ins across 173 partner and customer tenants. The activity occurred on October 15, 2026, and involved the use of Microsoft Graph access tokens.
This was not simply a conventional attack against individual employee accounts. The attacker abused a trusted application identity and inherited the permissions that had already been granted to it.
As a result, conventional user-focused defenses alone might not have prevented the activity.
Why This Attack Is Different From Traditional Account Compromise
Many organizations focus their identity security strategies on usernames, passwords, phishing prevention, and multi-factor authentication (MFA).
These controls remain essential, but modern cloud environments also rely on application identities, service principals, API credentials, and OAuth permissions.
An application identity allows software to authenticate and perform authorized operations without a person signing in interactively.
When a trusted application’s credentials are compromised, attackers may be able to operate through that application rather than through a stolen employee account.
This can create several challenges:
- No individual employee password needs to be stolen.
- Regular user MFA prompts may not be involved in the application authentication flow.
- The activity may initially resemble legitimate application operations.
- Existing application permissions can provide access to multiple services.
- A compromised multitenant application can create risk across many customer environments.
- Password resets alone may not stop application-based access.
This is why organizations must monitor both human identities and non-human identities used by applications, automation, integrations, and cloud services.
What Data Could Be at Risk?
The potential impact depends on the permissions granted to the affected application in each tenant.
Depending on those permissions, unauthorized access could potentially involve:
Exchange Online: Business emails, attachments, communications, and other mailbox information.
OneDrive and SharePoint: Internal documents, project files, customer information, business records, and confidential organizational material.
Microsoft Teams: Collaboration information, conversations, and other accessible Teams data.
Microsoft Entra ID and Microsoft Graph: Directory information, application configurations, identities, groups, and other resources permitted by the application’s access rights.
For organizations handling regulated or confidential information, this type of access can create privacy, operational, financial, and compliance concerns.
Importantly, unauthorized authentication does not automatically prove that every accessible file or message was stolen. The actual impact must be established through investigation, available audit evidence, and confirmation from the affected service provider.
ConnectWise reported that it had no indication at the time of its advisory that partner backup data had been accessed. Organizations should nevertheless assess their own environments rather than assume that the absence of confirmed data theft means no investigation is necessary.
Privilege Escalation Creates an Additional Concern
The incident involved more than suspicious authentication.
Huntress also reported activity in at least one partner tenant involving another ConnectWise application. The application was observed assigning itself the Global Administrator role and adding new client secrets to other trusted applications.
This type of activity is especially concerning because it can create additional access paths.
Even if the original compromised application is disabled, credentials added to other application registrations may remain valid until they are identified and removed.
Attackers who establish persistence through trusted applications may attempt to maintain access, increase privileges, or reach additional resources.
This reinforces the importance of investigating the entire identity and application environment rather than focusing only on the initially compromised credential.
Security teams should review:
- Unexpected directory role assignments
- Newly created application secrets and certificates
- Changes to enterprise application permissions
- Unusual service principal sign-ins
- Unexpected Microsoft Graph activity
- Changes to Conditional Access policies or exclusions
- Suspicious access from unfamiliar IP addresses
- Unusual activity involving privileged applications
These indicators should be assessed together and against known legitimate administrative activity. A single indicator, such as a particular IP address or user agent, should not be treated as definitive proof of compromise on its own.
Why Managed Service Providers Face Elevated Risk
Managed service providers (MSPs) often manage Microsoft 365 environments, backups, identities, security configurations, and IT operations for multiple customers.
This centralized operating model offers significant efficiency, but it can also concentrate risk.
If an application or credential has access across multiple customer tenants, a single compromise can potentially affect several organizations at once.
The same challenge applies to other trusted service providers and enterprise integrations.
Organizations should therefore evaluate not only the security of their own cloud environments, but also the permissions, authentication mechanisms, and incident response capabilities of their technology partners.
Third-party security should be treated as an ongoing operational responsibility, not simply a procurement checklist.
Immediate Security Actions for Microsoft 365 Administrators
Organizations using ConnectWise Cloud Backup or related applications should follow current vendor and Microsoftstyle=”color: #008000;” guidance and determine whether their environments are affected.
In the Microsoft Entra admin center, examine the Service principal sign-ins logs rather than relying exclusively on regular user sign-in logs.
Investigate unexpected authentication activity involving the ConnectWise Cloud Backup application, particularly activity associated with the reported suspicious source IP address, 144.172.64[.]128.
The reported Cloud Backup application ID is:
506e08f9-6e9a-4da4-942b-a099a03644ae
Validate suspicious events against your organization’s expected application behavior and the latest vendor guidance.
2. Disable Affected Applications When Advised
Follow ConnectWise and Microsoft incident guidance for affected deployments. The published recommendations include disabling the implicated application until the vendor confirms that its credentials have been reset and the environment is safe.
Where instructed, disable the relevant service principals rather than deleting them immediately. Deletion can remove consent and complicate recovery, while disabling can help stop new application authentication.
Coordinate this action with backup and recovery teams because disabling a backup integration may interrupt scheduled backup operations.
3. Audit Application Secrets and Certificates
Review application registrations and enterprise applications for unexpected credentials added since October 13, 2026, as well as suspicious permission or configuration changes.
Investigate any unfamiliar client secrets, certificates, or changes to application ownership and permissions.
Removing the original compromised access path may not be sufficient if other credentials were planted during the intrusion.
4. Review Privileged Roles and Permissions
Inspect Microsoft Entra audit logs for unexpected Global Administrator assignments, application role changes, and other privilege modifications.
Remove unauthorized assignments and credentials after validating the findings and following your incident response procedures.
5. Investigate Potential Data Access
Review available Exchange, SharePoint, OneDrive, Teams, and Microsoft Graph audit information for suspicious activity.
Remember that some application-based operations, particularly certain directory reads, may not leave complete or readily available audit evidence. A lack of visible data access events should not be treated as conclusive proof that no exposure occurred.
6. Strengthen Application Identity Governance
Maintain an inventory of enterprise applications, service principals, permissions, owners, secrets, and certificates.
Apply least privilege, review application consent regularly, rotate credentials securely, and remove integrations that are no longer required.
7. Prepare for Third-Party Security Incidents
Ensure that incident response plans cover compromised vendors, cloud integrations, application identities, and managed service providers.
Organizations should know how to disable a trusted integration, preserve evidence, assess affected data, restore essential services, and communicate with customers and regulators when necessary.
Industries That Should Pay Attention
The risks demonstrated by this incident extend beyond IT service providers. Any organization relying on Microsoft 365, cloud collaboration, managed backups, or third-party applications may face similar challenges.
Financial Services and Banking
Banks, investment firms, payment providers, and fintech organizations use cloud platforms to manage sensitive communications, business records, and customer information.
COE Security can help assess Microsoft 365 configurations, application permissions, identity controls, cloud security, and data protection measures while supporting compliance-focused security programs.
Healthcare and Life Sciences
Healthcare organizations must protect patient information, clinical documentation, employee records, and administrative communications.
COE Security can help evaluate cloud access controls, third-party integrations, data governance, vulnerability management, and incident response readiness to strengthen protection for sensitive information.
Retail and E-commerce
Retailers depend on cloud collaboration, customer service platforms, supplier communications, and business applications.
COE Security can help assess cloud environments, application integrations, identity security, API exposure, and data protection controls to reduce the risk of unauthorized access.
Manufacturing and Industrial Organizations
Manufacturers use cloud services for engineering collaboration, supplier management, procurement, and operational coordination.
COE Security can help review cloud access, privileged identities, connected applications, infrastructure security, and business continuity measures to reduce the risk of compromised enterprise accounts disrupting operations.
Government and Public Sector
Government agencies manage sensitive citizen information, internal communications, administrative records, and public services.
COE Security can help assess application permissions, cloud security configurations, identity management, monitoring capabilities, incident response processes, and compliance requirements.
Technology, SaaS, and Managed Service Providers
Technology companies and MSPs may have access to multiple customer environments, making application identity security and tenant isolation particularly important.
COE Security can help review service principals, third-party integrations, cloud permissions, application security, security monitoring, and incident response processes to identify weaknesses and improve resilience.
Conclusion
The ConnectWise incident demonstrates how a single compromised application credential can create security risks across multiple Microsoft 365 tenants.
The broader lesson is that cloud security must extend beyond employee accounts and traditional authentication controls. Trusted applications, service principals, API credentials, and third-party integrations can hold extensive permissions and become attractive targets for attackers.
Organizations should strengthen application identity governance, monitor service principal activity, review privileged changes, investigate suspicious data access, and maintain clear procedures for responding to third-party compromises.
For managed service providers and enterprises alike, proactive monitoring and least-privilege access are essential to limiting the impact of a compromised integration.
Cyber resilience depends not only on protecting an organization’s own systems, but also on understanding and managing the security risks introduced by the services it trusts.
About COE Security
COE Security partners with organizations in financial services, healthcare, retail, manufacturing, and government to secure AI-powered systems and ensure compliance.
Our offerings include:
- AI-enhanced threat detection and real-time monitoring
- Data governance aligned with GDPR, HIPAA, and PCI DSS
- Secure model validation to guard against adversarial attacks
- Customized training to embed AI security best practices
- Penetration Testing (Mobile, Web, AI, Product, IoT, Network & Cloud)
- Secure Software Development Consulting (SSDLC)
- Customized CyberSecurity Services
In addition, COE Security helps organizations strengthen cloud and identity security through Microsoft 365 security assessments, Microsoft Entra ID configuration reviews, service principal and OAuth permission assessments, cloud security reviews, vulnerability management, third-party risk assessments, application security testing, incident response planning, continuous monitoring, and compliance-focused cybersecurity consulting.
For financial services and banking, we help assess identity controls, cloud applications, sensitive data access, privileged permissions, and monitoring processes while supporting applicable security and compliance requirements.
For healthcare and life sciences, we help protect sensitive information through cloud security reviews, data governance, access control assessments, vulnerability management, and incident response readiness.
For retail and e-commerce, we help assess cloud applications, customer-facing systems, third-party integrations, APIs, identity controls, and data protection measures.
For manufacturing and industrial organizations, we help evaluate cloud access, enterprise identities, connected applications, infrastructure security, and business continuity controls.
For government and public sector organizations, we help strengthen cloud security configurations, application permissions, identity governance, threat monitoring, and compliance-aligned security practices.
For technology, SaaS, and managed service providers, we help assess multitenant security risks, service principals, application credentials, third-party integrations, cloud configurations, and incident response capabilities.
Our goal is to help organizations identify security gaps, reduce cyber risk, protect sensitive information, strengthen resilience, and maintain compliance across increasingly connected digital environments.
Follow COE Security on LinkedIn for ongoing insights into safe, compliant AI adoption, emerging cyber threats, cloud security, identity protection, and practical cybersecurity strategies to stay updated and cyber safe.
Click to read our LinkedIn feature article