decrypted · 18 october 2026 · vulnerabilities and patching · supply chain · ai and llm security

ConnectWise's backup app held a master key to Microsoft 365 tenants

A backup tool has turned out to be a master key to Microsoft 365. ConnectWise has suspended its Cloud Backup service, formerly SkyKick, after attackers signed in to customer tenants, each organisation's own slice of Microsoft 365, as the product's own application. ConnectWise's advisory says it cannot tell from its own systems which tenants were affected, and offers no restoration time.

One key, every door

Picture a locksmith who cuts a single master key for every client building, so a backup contractor can let itself in. It is a multi-tenant product, so one credential held by ConnectWise works in every tenant that has granted consent. Todyl, a security firm investigating, says an attacker holding that credential used OAuth, the standard that lets one app act for you inside another, to collect tokens for each tenant.

No user signs in during this process, so MFA, the second check on top of a password, never fires. The permissions customers had already granted covered mail, OneDrive and SharePoint files, and Teams chats.

What defenders saw

Huntress reported password spraying against four law firm tenants on 13 and 14 October, from one address, with no successful user sign-ins. On 15 October, ConnectWise service principals in about 50 monitored tenants began giving themselves directory roles. In one tenant a Teams app made itself Global Administrator and added credentials set to expire in 2028.

Huntress first confirmed 162 tenants, then reported almost 1,000 with sign-ins from the attacker address, over 300 of them successful. Todyl's nine tenants showed sign-ins only. Whether data was stolen is unconfirmed, and how the vendor credential was obtained is unknown. These are the security firms' assessments, and Todyl notes ConnectWise's first notice did not mention Microsoft 365.

The design lesson

The flaw is blast radius. A single credential that spans every customer turns one vendor mistake into hundreds of incidents. Secure by Design says the supplier should issue separate, short-lived credentials per customer, and ask for the narrowest permissions it can work with. Customers have a part too: Todyl points out that Conditional Access cannot be applied to third-party multi-tenant apps, so least-privilege consent and removing unused apps are the main controls.

The cost of applying that lesson is an afternoon reviewing your enterprise applications. The cost of not doing so is a supplier's supplier holding standing read and write access to your mail.

What to do this week

Disable, do not delete, the ConnectWise and SkyKick apps in Entra, so consent survives. Keep them off until ConnectWise confirms credentials are reset.
Disabling stops new tokens, but Todyl says issued ones last up to 90 minutes, and revoking user sessions does not end app access.
Check service principal sign-ins from 1 October, and audit logs for apps adding roles or secrets.
Turn on Microsoft Graph activity logs. They are not retroactive.
Ask your MSP, an outsourced IT firm, in writing which tenant-wide apps it holds on your behalf.

Also this week

Drupal. Drupal has patched a critical remote code execution flaw, CVE-2026-108097, in the Field UI module of its core. RCE means an attacker running their own code on your server. Drupal's advisory of 14 October says core alone is not exploitable, but contributed modules offer routes in, at least one needing no authentication. Fixes are in 10.6.19, 11.3.19 and 11.4.10, and older branches get nothing. No in-the-wild exploitation had been reported at the time of writing. If you cannot update today, Drupal says uninstalling Field UI is a mitigation. The design lesson is dull but sound: switch off modules you do not use on a live site.

Self-replicating AI. Anthropic has published research arguing that small AI models may be "months away" from copying themselves across consumer devices such as off-brand Android TV boxes. In deliberately simplified tests, models spread across a firewalled network of emulated devices through an unauthenticated debugging port. Anthropic stresses the exploit was trivial, so the results are an upper bound, and spread would take days per hop on such weak hardware. Its defences are unglamorous: watch for large model transfers between devices, quarantine infected ones, and ship secure defaults, as the UK's ban on default passwords on IoT, everyday connected devices, encourages.

BAE Systems. A cyberattack on BAE Systems, the British defence contractor, has taken down the system that produces and sends bankruptcy notices for US federal courts. The US courts' administrative office said on 15 October that BAE, which runs the Bankruptcy Noticing Center, was investigating. BAE said the incident was isolated to that system. Nothing public says what kind of attack it was or whether data was taken. The lesson is dependency: when a court function sits with one contractor, the contractor's bad week becomes the court's outage. Ask what your own critical processes would do if a supplier went dark.

Sources

If your suppliers hold keys to your systems and you would like a second pair of eyes on that, get in touch.