How the attack exploited existing permissions

The hackers used a compromised application identifier belonging to ConnectWise Cloud Backup (formerly SkyKick Cloud Backup) to infiltrate Microsoft 365 environments. According to Huntress, the application requires extended access to mailboxes, OneDrive, SharePoint, and Teams to function, allowing attackers to inherit these privileges once the identifier was compromised. Microsoft confirms that malicious actors abused pre-existing permissions, including Directory.ReadWrite.All, to read and write emails, files, and Teams chats without triggering multi-factor authentication (MFA) alerts.

The attack originated from the IP address 144.172.64[.]128, used to generate Microsoft Graph tokens in the targeted tenants between October 15 and 16, 2026. Connections were made automatically, with intervals of a few seconds, suggesting the use of scripts to traverse environments. Todyl notes that the initial permissions granted to the application already provided full access to the data, thus facilitating exploitation.

The initial permissions granted to the application already provided full access to the data, thus facilitating exploitation by the attackers.

The stages of the intrusion and persistence attempts

As early as October 13, 2026, password spraying attempts were observed against four law firms from the same IP address, although without confirmed success. On October 15, Microsoft detected unauthorized authentication attempts via a principal service linked to SkyKick, which assigned itself the Exchange Administrator role in at least one tenant. Huntress reports that in nearly 50 environments, attackers sought to maintain access by adding additional credentials or assigning roles such as Global Administrator.

Malicious actors also used the Microsoft Graph API for reconnaissance attempts, as confirmed by Microsoft Threat Intelligence. Meanwhile, ConnectWise suspended access to its Cloud Backup service after detecting the incident, but tokens already issued remain valid for up to 90 minutes, even after the application is deactivated.

Recommendations to limit the damage

ConnectWise recommends checking the connections of service principals in Microsoft Entra ID and revoking unnecessary permissions. Microsoft, for its part, advises reviewing application credential changes, OAuth authorizations, and activities related to the Graph API. Blumira proposes an immediate measure: disabling the application via its Application ID (506e08f9-6e9a-4da4-942b-a099a03644ae) in Microsoft Entra, although this does not revoke already issued tokens.

Organizations using SkyKick Cloud Backup, SkyKick Cloud Manager, or ConnectWise Cloud Backup may be potentially affected. Huntress warns about third-party approved applications that may have received additional client secrets, such as in a tenant where the ConnectWise application added privileges to other tools, including those of Huntress itself.

What this changes here

In Benin and West Africa, where businesses and government agencies increasingly rely on cloud solutions like Microsoft 365 for collaboration and storage, this attack underscores the importance of monitoring permissions granted to third-party applications. Local managed service providers (MSPs) using tools like ConnectWise Cloud Backup may see their clients exposed to similar risks, especially if application identifiers with broad access are not regularly audited.

Organizations could conditionally strengthen their access controls by limiting third-party application permissions to strict operational needs, enabling alerts for role or approved application changes, and systematically checking suspicious connections via tools like Microsoft Entra ID. Increased vigilance over reconnaissance attempts via the Graph API would also be crucial to quickly detect any malicious activity.