ConnectWise Cloud Backup Supply Chain Attack Breaches Microsoft 365 Tenants
Researchers have documented successful authentication events across 173 customer and partner environments after a ConnectWise cloud services supply-chain breach granted unauthorized entities entry to Microsoft 365 assets. The incident centers on credentials associated with ConnectWise Cloud Backup, formerly known as SkyKick, raising security concerns about attackers exploiting permissions already entrusted to business software.
ConnectWise Shuts Down Cloud Backup Access After Unauthorized Sign-Ins
ConnectWise confirmed unauthorized access to application identities within its Cloud Backup environment. In an October 17 update on its service-status page, the company announced it was shutting off application access, which interrupted customer backups while investigation and remediation continued. LinkedIn reported that ConnectWise stated it found no indicators that stored partner backup data had been compromised. Whether attackers managed to breach connected Microsoft 365 tenants is an entirely separate matter from the security status of the backup archives themselves, meaning that particular assertion must be evaluated strictly within its defined boundaries. Reports regarding the malicious activity began circulating on Friday according to BleepingComputer, with administrators spotting unauthorized intrusions into client data within Microsoft 365 environments stemming from a potential ConnectWise and SkyKick compromise.
Trusted Integration Beencomes the Entry Point for Attackers
The technical significance lies in the identity used to gain access. An application approved to perform business tasks can operate independently of the employees whose information it processes. Guidance published by Microsoft concerning application-only access details how a given service verifies its own identity to obtain a Microsoft Graph access token. Administrators approve its application permissions in advance, meaning subsequent token requests do not require another consent prompt. Automated processes rely heavily on this functionality, given that background programs lack the ability to wait for human intervention every time an approved action needs to be executed. However, this creates a security dependency where whoever controls the application’s authentication material may exercise the permissions granted to that identity. Cloud environments can thus become vulnerable to threats even in the absence of a phishing message or a user manually authorizing a suspicious login attempt.
Vendor Identity Affects Multiple Customers Across Boundaries
Documentation from Microsoft regarding applications and service principals explains how a multi-tenant application establishes a local identity in each customer environment where it is used. That local identity, called a service principal, determines the application’s access within the tenant. The application’s global identifier and its local service-principal object are related but distinct. For administrators, identifying the correct vendor application is only the beginning, as they must also establish what permissions its local instance holds. Microsoft Threat Intelligence labeled the event as an active supply-chain breach, noting in reports shared by BleepingComputer that adversaries likely leveraged pre-existing privileges such as Directory.ReadWrite.All. This makes application inventory a critical business-risk issue.
Huntress and Todyl Expand Investigations Beyond Cloud Backup
In an update released on October 17, Huntress expressed high assurance that malicious actors had likewise targeted ConnectWise Cloud Management tools associated with SharePoint Online, Microsoft Teams, and Exchange Online. Huntress identified the legitimate Cloud Backup application ID 506e08f9-6e9a-4da4-942b-a099a03644ae used in the attacks. Rather than deleting compromised applications, the organization recommended disabling them, auditing certificates and secrets introduced after October 13, and purging unauthorized directory roles and credentials. Furthermore, Huntress noted that a ConnectWise Teams management tool elevated its own privileges to Global Administrator and injected credentials into a partner-specific, single-tenant Huntress utility. Meanwhile, Todyl independent investigation identified unauthorized application sign-ins in monitored tenants, noting that application permissions provided access to email, attachments, OneDrive, SharePoint files, and Teams chats.
Employee Multi-Factor Authentication Fails to Resolve Cloud Workload Risks
Microsoft workload-identity security documentation explains that application identities cannot perform multi-factor authentication in the way human users do. Stronger employee authentication, while essential, does not by itself secure an application’s independent access. A user password reset addresses a different identity from the service principal used by an unattended integration. Furthermore, Microsoft states that its workload-identity policies apply to eligible single-tenant service principals registered in the organization’s tenant, leaving third-party SaaS applications outside that policy coverage.
Administrators Examine Service-Principal Logs and Active Connections
Microsoft maintains a separate category of service-principal sign-in logs for application authentication. These events do not involve a user signing in, meaning reviews of employee login activity alone can miss relevant evidence. ConnectWise guidance directs customers to this application-sign-in view and identifies the IP address 144.172.64.128 as a suspicious address requiring investigation. Additionally, Microsoft Graph activity logs provide request-level information, including application identifiers, client IP addresses, request methods, target URIs, and response codes, though these records require an Entra ID P1 or P2 tenant licence.
Backup Disruption Creates Secondary Business Continuity Concerns
Alongside the security investigation, customers must manage interrupted backup operations. ConnectWise stated that existing archives were unaffected by the service interruption and would be accessible once services were restored. Impacted enterprises now face logistical recovery planning dilemmas regarding the volume of data generated during the backup outage and the potential restoration challenges should another crisis strike during this vulnerable window. Organizations must establish their last successful recovery point and confirm available restoration options with their provider.
Keep reading