Supply Chain Compromise: ConnectWise Cloud Backup Credentials Exploited in M365 Tenant Attacks
Security Teams Urged to Audit OAuth Grants Following Credential Theft
Security researchers have identified an active, sophisticated campaign targeting Microsoft 365 environments by leveraging compromised credentials belonging to the ConnectWise Cloud Backup service. The ongoing incident, which has already impacted at least 173 customer tenants, highlights the significant risks posed by third-party applications granted excessive permissions within enterprise cloud ecosystems.
The threat actors are utilizing a compromised service principal credential to authenticate to the Microsoft Graph API. By mimicking the behavior of the legitimate backup service, the attackers have successfully obtained tokens that grant them the same broad access rights previously consented to by administrators. This access includes the ability to read and potentially manipulate data across Exchange mailboxes, OneDrive, SharePoint, and Microsoft Teams. Because the backup service is designed to function across multiple customer environments, the compromise has enabled the adversaries to move laterally between tenants with alarming speed, often following an alphabetical targeting pattern.
Technical analysis indicates that the attackers are not merely content with passive data exfiltration. In several observed instances, the threat actors have utilized the inherited permissions to escalate their own privileges. By modifying existing service principals, the intruders have successfully assigned themselves the Global Administrator role within target environments. Furthermore, they have inserted new client secrets into other trusted, privileged management and security applications, effectively creating persistent backdoors that survive even if the initial compromised credential is rotated or the original application is disabled.
Immediate Remediation and Defensive Measures
In response to the discovery, ConnectWise has temporarily suspended access to the Cloud Backup application. However, security professionals should not rely solely on vendor-side actions. Experts emphasize that revoking user sessions is insufficient to mitigate the risk, as existing tokens may remain valid for up to 90 minutes after a session is terminated. Organizations must actively audit their Entra ID environments to identify signs of unauthorized access.
Security teams are advised to perform the following actions immediately:
Navigate to the Microsoft Entra Admin Center and examine the ‘Service principal sign-ins’ tab under Monitoring. Filter by the specific Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae to identify any authentication activity originating from the suspicious IP address 144.172.64.128, or other non-standard egress points. Security administrators should also audit all OAuth grant activity and check for any new credentials added to service principals since October 13, 2026. If any unauthorized modifications are detected, the affected application secrets should be rotated immediately, and the compromised service principal should be thoroughly investigated for further persistence mechanisms.
This incident serves as a stark reminder of the ‘confused deputy’ problem inherent in modern cloud-integrated supply chains. When high-privilege applications are granted excessive scopes, a single point of failure at the vendor level can cascade into a widespread security event across their entire customer base. Organizations must implement strict least-privilege principles for all third-party integrations and maintain robust, real-time monitoring of service principal activity to detect anomalous behavior before it escalates into a full-scale compromise.
