Investigation: Unauthorized Access Through the ConnectWise Cloud Backup Microsoft 365 App

This is a running post. We will add findings as the investigation develops, with the latest updates recorded at the top. All times are UTC.

Update — October 26, 2026: ConnectWise credential reset and restoration guidance

ConnectWise confirms it completed a full account and credential reset in the affected Cloud Backup environment on October 19. The company is preparing phased partner onboarding but affected application connections should remain disabled until formal restoration instructions are available. Microsoft's investigation also identified unauthorized credential modifications and privileged role changes in some customer environments. Administrators should complete the tenant-level remediation steps below before re-enabling affected applications.

Update — October 23, 2026: Microsoft attributes the campaign to Storm-0940 and AI-driven automation

On October 21, Microsoft ThreatIntelligence assessed that Storm-0940,a China-state aligned actor, was responsible for the ConnectWise Cloud Backup supply chain compromise. Microsoft further reports the actor used ARTEX, an open-source agentic AI penetration testing framework, to automate the campaign at machine speed. The ascending-GUID tenant crawl Todyl observed and reported on October 16 is consistent with automated targeting.

Microsoft's reporting also changes the risk picture for impacted organizations and MSPs alike. In multiple environments outside Todyl's visibility, the actor went beyond sign-in to change application credentials and assign privileged roles. Every MSP and customer with an affected ConnectWise app should re-hunt for persistence, not only for sign-ins.

Key updates

A China-state aligned actor(designated as Storm-0940 by Microsoft Intelligence) abused the trustedMicrosoft 365 integration of ConnectWise Cloud Backup (formerly SkyKick Backup)to authenticate into customer tenants as the application itself. Microsoft attributes the activity to Storm-0940 and reports the actor used agentic AI to run it at machine speed.

Microsoft's October 21 research places the observed activity inside a larger campaign. Microsoft reportsStorm-0940 performed password-spraying attacks from the same IP range betweenOctober 10–14, attempted sign-ins to more than 2,250 tenants using multipleConnectWise app credentials, and in some environments added application credentials, changed groups and privileged roles, and read Azure Key Vault secrets.  

The central business risks connected to this threat actor’s observed and historical behaviors and this campaign are data exposure and persistent access. Each affected organization should keep the ConnectWise apps disabled, hunt and monitor for credential and role changes made by any ConnectWise app, and treat its data as potentially exposed. ConnectWise first published an advisory on October 16 and has since expanded its containment guidance; the source IP it listed matched the oneTodyl observed.

What this means for MSPs

This campaign shows that an MSP's most trusted integrations are also its largest attack surface. Compromised vendor application credentials were used to attempt sign-ins across more than2,250 tenants without phishing individual users or executing malware on their endpoints.

Additional lessons to consider as this evolves:

1. SIEM and SOC are operational necessities for MSP operations, not compliance checkboxes. Nothing in this attack ran on an endpoint. The actor used a legitimate app identity, a valid token, and Microsoft Graph, while EDR and firewalls had nothing to see. The signals that mattered lived in Entra service principal sign-ins, Graph activity logs, directory audit events, and unified audit logs, requiring continuous collection, correlation, and action on them in minutes. At the speed Microsoft describes, a weekly log review is a post-mortem.

2. Nation-state interest means the risk is espionage and persistence, not just ransomware. A China-aligned actor reading mailboxes, SharePoint, and Key Vault secrets is collecting intelligence: contracts, credentials, client communications, and potentially establishing access needed to come back later. Microsoft observed added app credentials and privileged roles that can outlive the original app being disabled. The damage may never announce itself the way ransomware does.Continuous monitoring, data protection, and environment hardening should be key actions to quickly implement and/or evaluate for impacted or concerned organizations.

-End Update

Key points

• In Todyl-monitored tenants, an unauthorized party authenticated to Microsoft Graph as the ConnectWise CloudBackup application.
• The access inherited the app's existing consent, which permits read/write access to mail and attachments (full mailbox access through Exchange Web Services), OneDrive and SharePoint files, and Teams chats, including the ability to restore data.
• We found no directory changes tied to the activity in any Todyl-monitored tenant: no new secrets, applications, consents, or role assignments by the backup app. Microsoft has since reported credential modifications and privileged role changes in other affected environments.
• Revoking user sessions does not end this access. Disabling the app in a tenant stops new tokens from being issued there, though tokens already issued stay valid for up to 90 minutes.
• ConnectWise completed a reset of accounts and credentials in the affected Cloud Backup environment on October 19. Affected applications should remain disabled until ConnectWise provides formal restoration instructions and each tenant has been reviewed for unauthorized changes. The vendor's credential reset does not remove persistence established inside customer tenants.

Todyl Identified Indicators

Pattern: Tenants were hit in strictly ascending tenant-GUID order, about 1–6minutes apart. There's a 43-minute gap between 3282… (07:26) and 6ff6… (08:09).The ascending tenant GUID pattern is consistent with an automated tool crawling a sorted list of consenting tenants. Treat every tenant with the affected ConnectWise app enabled as potentially exposed, even if no suspicious sign-ins have been identified. Review each tenant for unauthorized activity before considering the app safe to re-enable.

Executive Summary

Todyl identified that a third-partyMicrosoft 365 application, ConnectWise Cloud Backup (formerly SkyKick Backup)was used by an unauthorized party to sign in to Microsoft 365 tenants Todyl monitors. In those tenants, the sign-ins occurred on October 15, 2026, between07:11 and 08:47 UTC. The application is a legitimate, vendor-published backup app that many organizations have approved in their tenant. Todyl's analysis shows that an attacker holding a valid credential for that application used it to authenticate directly to Microsoft 365 as the application itself, not as any individual user, from a rented hosting server unrelated to the backup vendor.

Todyl confirmed successful application sign-ins, one per tenant, performed by an automated script. Because the application already held broad, previously granted permissions in each tenant, those sign-ins gave the attacker the technical ability to read and write mail and attachments, OneDrive andSharePoint files, and Teams chats. In Todyl-monitored tenants, we found no evidence that the attacker created accounts, added permissions, changed passwords, or established persistence through the backup app. The ascendingGUID crawl is consistent with automated activity. Microsoft has since reported credential changes and privileged role modifications in other affected environments.

The central risks are  exposure and persistent access. Confirming exactly which data was copied remains limited by how Microsoft logs application activity, as described under Potential risk. Each affected organization should treat its data as potentially exposed, disable the affected applications, and complete the remediation steps below. Before re-enabling an app, review the tenant for unauthorized credentials, permission changes, and privileged role assignments, and followConnectWise's formal restoration instructions. ConnectWise first published an advisory on October 16 regarding unauthorized access associated with its CloudBackup environment. The source IP listed in that advisory matched the one Todyl observed. ConnectWise has since confirmed unauthorized access to application credentials and expanded its guidance for investigating affected Microsoft 365environments. The app-only authentication activity described in this post was independently identified by Todyl during its investigation.

Detailed Case Summary

How it originated

Todyl’s Cloud Anomaly Frame work detected suspicious behavior correlating to the known IoC IPs and affectedApplication ID, leading to an immediate threat hunt by Todyl MXDR. The team searched every Todyl-monitored tenant for sign-ins by the application, which appears in Entra ID as "ConnectWise Cloud Backup” (formerly SkyKickBackup; app ID 506e08f9-6e9a-4da4-942b-a099a03644ae).  

Attack vector: OAuth client credential abuse

ConnectWise Cloud Backup is a legitimate multi-tenant Microsoft 365 application. When an organization enables the service, a tenant administrator grants the app application permissions, which let it read data without a signed-in user. The app proves its identity using credentials held by the publisher, such as a client secret or certificate. Those credentials can be used to request app-only access tokens in tenants that have granted consent to the corresponding application.

1. Credential use. The actor presented the app's client secret to Microsoft Entra ID using the OAuth 2.0 client credentials flow.
2. Token issuance. Entra ID issued an app-only access token for Microsoft Graph in each tenant the actor targeted. No user interaction was required, so user-focused controls such as MFA and conditional access for users did not apply.
3. Sweep. The actor repeated the request between 07:11 and 08:47 UTC, all from the same IPv4 address.

Distinguishing the activity from legitimate backup

In Todyl-monitored tenants, legitimate backup activity originated from Microsoft-internal IPv6 addresses(logged in the fd00:: range). The malicious sign-ins differ on every axis we compared: a single commercial VPS IPv4 address, a Python scripting user agent, a single token per tenant rather than a recurring job pattern, and nine target tenants that have no active backup subscription. Taken together, these rule outa misconfigured or relocated backup job.

Potential risk

What the access allowed

The app's consent grants tenant-wide read/write access to mail and attachments (including full mailbox access through Exchange Web Services), OneDrive and SharePoint files, and Teams chats, plus the ability to restore data into the tenant. App-only access is not scoped to a single user, so every mailbox and site in the tenant was within reach once a token was issued.

Data access observed

• Tenants without an active backup subscription. A token was obtained, and we found no mailbox or file read records afterward. This is consistent with reconnaissance-stage access, and we have no evidence of bulk copying.
• Tenants with an active backup subscription. Read activity exists, but it cannot be attributed to the actor or to the backup service. Both use the same application identity. Microsoft 365 audit records for these reads do have IP fields and name the calling app, but the IP they show is Microsoft's own infrastructure, not the actor's. Per-request source IPs are recorded in MicrosoftGraphActivityLogs, which was not being collected for these tenants.

The absence of confirmed exfiltration is partly a visibility limit rather than a clean result. We recommend every affected organization treat its data as exposed.

Response

Detection

Todyl’s Cloud Anomaly Framework detected suspicious behavior correlating to the known IoC IPs and affected Application ID, leading to an immediate threat hunt by Todyl MXDR, who took the following actions:

Todyl actions

• Added 144[.]172[.]64[.]128 to Todyl's block list.
• Notified affected partners of the compromise by email and through MXDR channels.
• Initiated a threat hunt for signs of additional compromise based on IOCs.
• Multiple new detections built for IOCs and behaviors observed  

Recommended remediation

‍

ConnectWise Published Indicators

References

• ConnectWise Advisory page
• MicrosoftThreat Intelligence: Storm-0940 and ARTEX supply chain compromise
• ConnectWiseTrust Center: Cloud Backup advisories

Investigation Team

• Sean Yohe
• Sean Savold
• Thayer Shepherd
• Michael Neal