Post

Microsoft is tracking an active supply chain attack in which a threat actor compromised the trusted OAuth App of the backup application ConnectWise Cloud Backup (AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae), formerly SkyKick Backup, to obtain access tokens across customer tenants.

ConnectWise Cloud Backup is a multitenant application; customers grant consent for the application to operate in their tenants. We assess that the actor likely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory.ReadWrite.All.

On October 15, 2026, we observed broad successful service principal authentication originating from the IP address 144.172.64[.]128.

Follow-on activity included Microsoft Graph API reconnaissance and attempts to add additional credentials on the related service principal in target tenants to maintain direct access as a backdoor.

Microsoft Defender detects post-exploitation activity with the following alerts: - Any alert related to "Suspicious sign-in" - Graph API activity from a Microsoft threat intelligence IP address - Verified Threat Actor IP

We will continue to monitor this incident and will share updates as they become available. We encourage customers to check ConnectWise advisory for more information and additional guidance: msft.it/63322aQBLq.

Indicators of compromise (IOCs): - App name: ConnectWise Cloud Backup - AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae - Publisher name: SkyKick - Source IP: 144.172.64[.]128 - User agents: Python-urllib/3.12, python-requests/2.31, python-requests/2.34.2

Microsoft Threat Intelligence assesses that China state-aligned threat actor Storm-0940 was responsible for this supply chain compromise. Storm-0940 used the agentic AI pen testing framework ARTEX to automate attacks targeting hundreds of organizations globally. msft.it/63329aaj9h