Microsoft Threat Intelligence (@MsftSecIntel) on X

What it is

Microsoft Threat Intelligence is tracking an active supply chain attack on the ConnectWise Cloud Backup multitenant OAuth app (formerly SkyKick Backup, AppId 506e08f9-6e9a-4da4-942b-a099a03644ae). The actor compromised the vendor's app to obtain access tokens across customer tenants.

How it works

Customers grant consent to the app in their own tenants. Microsoft assesses that the actor likely abused permissions customers had already granted, including highly elevated ones such as Directory.ReadWrite.All. On 15 October 2026 Microsoft saw broad, successful service principal authentication from 144.172.64[.]128. Follow-on activity was Microsoft Graph API reconnaissance and attempts to add extra credentials to the app's service principal in target tenants, to keep direct access as a backdoor.

Preconditions / Affected

Any tenant that has consented to this app, which appears as ConnectWise Cloud Backup with publisher SkyKick. The risk grows with the permissions that were granted, and Directory.ReadWrite.All is the one the post names.

What to do

Review three things for this specific AppId: service principal sign-ins from unrecognized IP addresses, app credential changes, and OAuth grant activity.

Hunt on these indicators:

App name:    ConnectWise Cloud Backup
AppId:       506e08f9-6e9a-4da4-942b-a099a03644ae
Publisher:   SkyKick
Source IP:   144.172.64[.]128
User agents: Python-urllib/3.12, python-requests/2.31, python-requests/2.34.2

Microsoft Defender detects post-exploitation activity with these alerts:

• Any alert related to "Suspicious sign-in"
• Graph API activity from a Microsoft threat intelligence IP address
• Verified Threat Actor IP

Also look for Threat Intelligence alerts that match the IP against Graph API activity and service principal activity. Microsoft points customers to the ConnectWise advisory at msft.it/6013aQBvV.

Caveats

Use of customer-granted permissions is Microsoft's assessment ("likely"), not a confirmed finding. The incident is ongoing, and Microsoft says it will publish updates. The post gives no count of affected tenants, no way the vendor app was compromised, and no remediation steps such as revoking consent or rotating credentials. It names one source IP and generic Python user agents, so a clean match on those does not rule out other infrastructure.