By Hamza Faisal
No phishing email. No stolen password. No multifactor prompt. On October 15, unknown attackers walked into 173 Microsoft 365 tenants using a single compromised credential — one that belonged not to any user, but to an application customers had trusted with standing access to their mailboxes, files, and directories.
Security vendor Huntress said it observed confirmed unauthorized sign-ins across 173 partner and customer tenants using a credential tied to ConnectWise Cloud Backup, the cloud backup service for managed service providers that was formerly sold as SkyKick. Microsoft Threat Intelligence has confirmed the incident and is tracking it as an active supply-chain attack by an actor it calls UNC7017.
The access came from a single IP address, 144.172.64[.]128, between 06:13 and 08:34 UTC on October 15. According to Huntress researcher Jonathan Semon, the actor "moved through tenants in sorted GUID order, a few seconds apart, which points to a script working from a target list" — the hallmark of an automated campaign, not opportunistic probing.
One Key, 173 Doors
The power of this attack lies in how the credential worked. ConnectWise Cloud Backup is consented into customer tenants by MSPs so it can back up and restore Microsoft 365 data — which means the app holds broad, standing permissions over mailboxes, OneDrive, SharePoint, Teams, and directory data in every tenant where it is installed.
The stolen secret was a vendor-side client assertion from ConnectWise's own home tenant — not a password belonging to anyone inside a customer environment. So it was valid against every tenant where the application had been granted consent, and the attacker signed in as the application itself, inheriting everything the backup service could already touch. That makes the 173 confirmed tenants the observed floor, not the ceiling: the blast radius is every organization running the app.
Follow-on activity suggests the intrusion was more than a hit-and-run. Microsoft says the actor likely abused previously granted permissions including Directory.ReadWrite.All, conducted reconnaissance through the Microsoft Graph API, and attempted to add new credentials to the application's service principal — a classic persistence move that would give the attacker a separate way back in.
Why Normal Defenses Never Fired
This is the uncomfortable part for defenders. Because the attacker authenticated as a trusted application rather than a user, none of the identity protections most organizations invest in had a say. User passwords were irrelevant, and multifactor prompts were never triggered — app-only identities don't get MFA challenges.
Huntress also cautioned that the audit trail for this kind of access is thin: directory reads through Microsoft Graph may not produce the same audit evidence as ordinary mailbox or file activity, and "a lack of visible mail or file access does not establish that data was not taken." That same IP address had also been password-spraying four law firm tenants on October 13 and 14, though Huntress said it detected no successful user sign-ins there.
What Happened Next — and What to Do
ConnectWise disclosed unauthorized access to application identities associated with Cloud Backup on October 16, in a trust advisory first published at 1:47 p.m. EDT, and shut off Cloud Backup application access until further notice. The company says it has found no evidence that partner backup data was compromised, though the incident window remains open until the credential is rotated.
For organizations affected — any MSP running ConnectWise Cloud Backup or SkyKick, and every client tenant where the app was consented — the checklist is clear: audit the service principal's sign-in and consent history, review which permissions the app holds, look for newly added credentials on the app object, and tighten conditional access around service principals. The broader lesson is the one this incident keeps teaching: every third-party app you consent into your tenant is a key you cut, and attackers have learned to steal the key instead of picking the lock.
