ConnectWise Cloud Backup application abused in cross-tenant token sweep
ConnectWise Cloud Backup application abused in cross-tenant token sweep
On October 15, 2026, Sophos X-Ops researchers identified a series of service principal sign-ins in which a threat actor authenticated as the ConnectWise Cloud Backup application (formerly SkyKick) and requested app-only Microsoft Graph tokens from customer Microsoft 365 tenants. The malicious scanning activity originated from a single virtual private server (VPS) and continued for about 96 minutes. X-Ops researchers found no evidence of hands-on-keyboard activity and assess with high confidence that the threat actor ran a script that enumerated a list of tenants that had consented to the application.
The sign-ins required no user password and no multi-factor authentication (MFA) because the threat actor authenticated with the application’s own identity. This activity is consistent with abuse of a compromised vendor-held application credential. It is unclear how the credential was obtained or what the threat actor did with the obtained tokens.
ConnectWise published an advisory about the service interruption, as well as a technical investigation and remediation guide. The advisory notes that ConnectWise shut off Cloud Backup application access for partners and customers as a protective measure.;
Background
ConnectWise Cloud Backup is a Microsoft 365 product that operates through a multi-tenant Entra application. When a customer enables the product, they consent to the application in their tenant. This consent allows the vendor’s application identity to request Microsoft Graph tokens for the tenant to read data for backup. A threat actor who obtains the application’s credential can request the same tokens in every tenant that has granted consent.
Observed activity
X-Ops researchers observed the threat actor request one app-only Graph token for the Cloud Backup application in each targeted tenant. The reconnaissance began at 07:11 UTC on October 15, and the last observed scan was at 08:47 UTC. All requests originated from 144[.]172[.]64[.]128 and used the following User-Agents: Python-urllib/3.12 and python-requests/2.31.
Analysis revealed three characteristics that point to automated activity:
- Tenants were accessed in strictly ascending tenant GUID order.
- Requests were spaced one to six minutes apart.
- The sweep included tenants with no active backup subscription, which suggests the threat actor worked from a full list of tenants that had consented to the application, including those that were no longer active backup customers.
As of this publication, there is no evidence that the application created new secrets, applications, consents, or role assignments in the reviewed tenants.
Recommendations
Organizations that use or have ever used ConnectWise Cloud Backup or SkyKick products should take the following actions:
- Review Entra enterprise applications and remove consent for the applications that ConnectWise disabled.
- Review Entra sign-in logs during the October 15-17 timeframe, specifically service principal sign-ins for the indicators that have been associated with this activity.
- Review audit logs for new credentials, secrets, application registrations, consents, and role assignments made by these applications since October 13.
- Retrieve Microsoft Graph activity logs for tenants with active backup, if available, to evaluate how issued tokens were used.
- Follow the vendor’s remediation guidance, including credential rotation steps.
Countermeasures and indicators
SophosLabs continues to monitor the threat landscape for activity related to this incident and will deliver detections and protections as available.
The indicators in Table 1 can be used to detect activity related to this threat. Note that IP addresses can be reallocated.
| Indicator | Type | Context |
| 144[.]172[.]64[.]128 | IP address | Source of observed token sweep in ConnectWise incident |
| 144[.]172[.]64[.]99 | IP address | Attacker infrastructure in ConnectWise incident (reported by vendor; not observed in Sophos telemetry) |
| 144[.]172[.]64[.]60 | IP address | Attacker infrastructure in ConnectWise incident (reported by vendor; not observed in Sophos telemetry) |
| Python-urllib/3.12 | User-Agent | Used in ConnectWise incident |
| python-requests/2.31 | User-Agent | Used in ConnectWise incident |
Table 1: Indicators for this threat
About Author
