ConnectWise said it shut off Cloud Backup application access in its October 17 advisory, interrupting backup services while the existing cloud archive was unaffected by that service interruption. The notice followed Huntress’s report of unauthorized sign-ins in 173 partner and customer tenants using a compromised Cloud Backup credential. ConnectWise The Hacker News
What the 173 sign-ins tell administrators
Huntress’s reported count covers tenants with unauthorized sign-ins; it counts authentication, not confirmed data theft in every tenant. The app’s existing, tenant-approved permissions could allow access to mail and attachments, OneDrive and SharePoint files, Teams chats, and directory information. The scope depended on the permissions granted in each tenant. Huntress Todyl
A service-principal sign-in records an application’s authentication and token issuance. It does not, by itself, describe which files or messages the app read. In its monitored tenants without active backup subscriptions, Todyl found no mailbox or file read records after tokens were obtained. In tenants with active subscriptions, it could not attribute read events to the attacker rather than legitimate backup activity because both used the same app identity. Todyl also said Microsoft Graph activity logs, which can record a source IP for each request, had not been collected for those tenants. Todyl
Huntress tracked two distinct app activities
Huntress observed the Cloud Backup app using a credential to obtain Microsoft Graph tokens from 144.172.64[.]128 on October 15, 2026, between 06:13 and 08:34 UTC. The app’s ID is 506e08f9-6e9a-4da4-942b-a099a03644ae. Huntress
Earlier that day, a separate application, ConnectWise Cloud Management - MS Teams (24205314-2b89-4e07-a2a4-579e898a5640), assigned itself the Global Administrator role in one tenant and made nine changes to two other applications; six succeeded and three failed. Huntress had no source address for this activity and did not link it to the later Cloud Backup credential use. Huntress
| Time (UTC) | Observed activity | Application and scope |
| October 15, from 01:58 | ConnectWise Cloud Management service principals assigned directory roles, mostly Exchange Administrator, across roughly 50 Huntress-monitored tenants. Huntress | Cloud Management apps; roughly 50 monitored tenants |
| October 15, 03:44–03:49 | The Teams app assigned itself Global Administrator and made nine changes to two other apps in one tenant; six succeeded and three failed. Huntress | ConnectWise Cloud Management - MS Teams; one tenant |
| October 15, 06:13–08:34 | Huntress observed Microsoft Graph token use from 144.172.64[.]128. Huntress | ConnectWise Cloud Backup |
| October 17, 05:01 | ConnectWise said it shut off Cloud Backup app access, interrupting backup services; the existing archive was unaffected by that interruption. ConnectWise | ConnectWise Cloud Backup |
Where to inspect Cloud Backup sign-ins
ConnectWise directed administrators to Microsoft Entra’s Monitoring → Sign-in logs → Service principal sign-ins view and advised filtering for Cloud Backup’s application ID, 506e08f9-6e9a-4da4-942b-a099a03644ae. The company said the default User sign-ins view does not display the relevant activity. ConnectWise
Todyl said disabling the app prevents new tokens from being issued, while tokens already issued may remain valid for up to 90 minutes. Microsoft’s workload-identity Conditional Access documentation excludes Microsoft and third-party SaaS applications, including multitenant apps, from the policies it describes. Todyl Microsoft Learn
