{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/connectwise-cloud-backup--2026-10-16/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Microsoft 365","ConnectWise Cloud Backup (\u003c= 2026-10-16)","ConnectWise Cloud Management - MS Teams (\u003c= 2026-10-16)"],"_cs_severities":["critical"],"_cs_tags":["cloud-security","supply-chain","m365","identity-compromise"],"_cs_type":"advisory","_cs_vendors":["Microsoft","ConnectWise"],"content_html":"\u003cp\u003eThreat actors have obtained API secret credentials for ConnectWise Cloud Backup (formerly SkyKick) and ConnectWise Cloud Management - MS Teams applications. These credentials allow attackers to impersonate these legitimate service provider applications to authenticate into customer Microsoft 365 tenants. Because these applications are granted broad permissions to interact with Exchange, OneDrive, SharePoint, and Entra ID data, the compromise provides attackers with extensive read/write access. Observed activity beginning October 15, 2026, involves automated scripts iterating through target tenants to request Microsoft Graph tokens. Attackers have been observed using these elevated permissions to grant themselves Global Administrator roles and add malicious credentials to other applications within the target tenant, creating a persistent backdoor independent of the initial compromised integration.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttackers obtain valid API client assertions for ConnectWise service applications via a breach of the vendor infrastructure.\u003c/li\u003e\n\u003cli\u003eAttackers perform automated authentication to customer Microsoft 365 tenants using the compromised application identities from a hosting provider IP (144.172.64.128).\u003c/li\u003e\n\u003cli\u003eAttackers acquire Microsoft Graph API tokens with the permissions historically consented to the ConnectWise applications.\u003c/li\u003e\n\u003cli\u003eAttackers leverage the compromised app's directory permissions to escalate their privilege level to Global Administrator.\u003c/li\u003e\n\u003cli\u003eAttackers create new credentials for existing, unrelated applications within the tenant to ensure long-term persistence.\u003c/li\u003e\n\u003cli\u003eAttackers potentially exfiltrate sensitive data from mailboxes, OneDrive, and SharePoint repositories.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAt least 162 M365 tenants have been confirmed compromised as of October 16, 2026. The compromise allows attackers to read and potentially exfiltrate sensitive directory, email, and document data. The establishment of persistence via new application credentials means that even if the initial ConnectWise integration is disabled, the attacker maintains unauthorized access until the newly added fraudulent credentials are removed.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eImmediately disable the affected ConnectWise applications (App IDs: 506e08f9-6e9a-4da4-942b-a099a03644ae and 24205314-2b89-4e07-a2a4-579e898a5640) in your Microsoft 365 environment.\u003c/li\u003e\n\u003cli\u003ePerform a comprehensive audit of all applications in the Entra ID portal to identify and remove any unauthorized credentials added recently.\u003c/li\u003e\n\u003cli\u003eReview Microsoft Entra sign-in logs for any API-based authentication attempts originating from the identified malicious IP 144.172.64.128.\u003c/li\u003e\n\u003cli\u003eEnsure all newly added credentials for high-privilege applications are thoroughly vetted and approved by internal security teams.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-17T10:28:56Z","date_published":"2026-10-17T10:28:56Z","id":"https://feed.craftedsignal.io/briefs/2026-10-connectwise-m365-abuse/","summary":"Threat actors are leveraging compromised API secrets from ConnectWise Cloud Backup and MS Teams integration applications to gain unauthorized administrative access and establish persistence in Microsoft 365 environments.","title":"Unauthorized Access via Compromised ConnectWise M365 Vendor Credentials","url":"https://feed.craftedsignal.io/briefs/2026-10-connectwise-m365-abuse/"}],"language":"en","title":"CraftedSignal Threat Feed - ConnectWise Cloud Backup (\u003c= 2026-10-16)","version":"https://jsonfeed.org/version/1.1"}