Microsoft Threat Intelligence is tracking an active supply chain attack in which a threat actor compromised the trusted OAuth App of the backup application ConnectWise Cloud Backup (AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae), formerly SkyKick Backup, to obtain access tokens across customer tenants. ConnectWise Cloud Backup is a multitenant vendor application; customers grant consent for the application to operate in their tenants. We assess that the threat actor likely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory.ReadWrite.All. On October 15, 2026, we observed broad successful service principal authentication originating from the IP address 144.172.64[.]128. Follow-on activity included Microsoft Graph API reconnaissance and attempts to add additional credentials on the related service principal in target tenants to maintain direct access as a backdoor. Microsoft Defender detects post-exploitation activity with the following alerts: - Any alert related to "Suspicious sign-in" - Graph API activity from a Microsoft threat intelligence IP address - Verified Threat Actor IP Defenders should review service principal sign-ins from unrecognized IP addresses, app credential changes, and OAuth grant activity associated with this specific OAuth AppId. In addition, we recommend looking for Threat Intelligence alerts on matching of IP against the Graph API activity and service principal activities. We will continue to monitor this incident and will share updates as they become available. We encourage customers to check ConnectWise advisory for more information and additional guidance: msft.it/6013aQBvV. Indicators of compromise (IOCs): - App name: ConnectWise Cloud Backup - AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae - Publisher name: SkyKick - Source IP: 144.172.64[.]128 - User agents: Python-urllib/3.12, python-requests/2.31, python-requests/2.34.2

The October 2026 security updates are available. In addition, starting today, Microsoft is publishing Vulnerability Exploitability eXchange (VEX) statements for all Microsoft-assigned CVEs. Learn more: msft.it/6013aSA6V

Storm-2945, a sub-cluster of the Russian state actor Midnight Blizzard, has resumed their CaptiveCrunch campaign. msft.it/6019aWMDf First reported by Microsoft Threat Intelligence in July 2026, the campaign uses manipulated network traffic and captive portals in the hospitality sector to gain access to targets. The renewed activity is consistent with reporting from Black Lotus Labs suggesting that multiple managed service providers are implicated; Storm-2945’s continued access to these upstream providers has likely enabled this rapid re-deployment. We have updated our blog to provide more recent network infrastructure indicators, detections, and hunting guidance. We want to thank Google Threat Intelligence Group (GTIG) for their collaboration on tracking the reemergence of this activity.

Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability affecting internet-facing mail servers that enabled compromise without authentication or user interaction. msft.it/6015aYZ6L Successful exploitation led to webshell deployment, reverse shells, privilege escalation, persistent remote access tooling, and collection of authentication and mailbox data. Microsoft observed both automated payload delivery and hands-on-keyboard activity on compromised mail servers. Analysis of confirmed compromises revealed multiple attack paths and pre-disclosure reconnaissance activity targeting the same injection path before public disclosure. Read the full research for technical details, detection opportunities, and mitigation guidance.

The August 2026 security updates are available: