Compromised ConnectWise Cloud Backup credential used to sign in to Microsoft 365 tenants

ConnectWise has suspended its Cloud Backup service, the Microsoft 365 backup product formerly known as SkyKick, after finding unauthorized access to application identities linked to it. Security firms Huntress and Todyl, as well as Microsoft, have reported that an attacker used the backup application's credential to authenticate directly to customer Microsoft 365 tenants and obtain Microsoft Graph access tokens, inheriting the wide permissions customers had already granted the app. According to BleepingComputer and The Hacker News, Microsoft Threat Intelligence called it an active supply-chain attack, said it saw Graph API reconnaissance and attempts to add credentials to keep backdoor access, and assessed that previously granted permissions such as Directory.ReadWrite.All were likely abused.

ConnectWise said in its advisory that it identified the issue earlier in the week and first disclosed attempted unauthorized access on 16 October. Early on Saturday it said it was cutting off Cloud Backup application access, halting backups until further notice. A later update said the company had revoked certificates for affected application connections for all users, that the shared credentials the service relied on no longer work, and that an outside incident response firm is assisting. ConnectWise said it has seen no successful threat activity in environments it monitors since then and has no evidence that the encrypted backup archives were accessed. It added that the service's design gives it no view into downstream customer environments, so it cannot tell on its own whether a given tenant was affected. Whether a product flaw played a part has not been established, and how the credential was exposed remains under investigation. No restoration time has been given.

The number of affected tenants differs by source. Huntress wrote that, as of 19:00 UTC on Friday, it had confirmed unauthorized sign-ins in 162 tenants, and BleepingComputer reported Huntress's figure as at least 162. The Hacker News reported that Huntress had observed confirmed unauthorized sign-ins in 173 tenants. Todyl, as cited by BleepingComputer, examined intrusions in nine tenants and found only sign-in activity, with no indication that the attacker created accounts, added permissions, reset user logins or gained persistence through the backup app. ConnectWise's advisory gives no tenant count, and Huntress noted the credential works wherever the app has been granted consent, so exposure is not limited to confirmed cases.

Huntress said the 15 October sign-ins ran between 06:13 and 08:34 UTC and moved through tenants a few seconds apart in sorted order, which it read as a script working from a target list. In roughly 50 tenants it monitors, service principals for ConnectWise Cloud Management apps assigned themselves directory roles, mostly Exchange Administrator; Huntress said the user agent pointed to vendor automation but that it had not confirmed this with ConnectWise. In one tenant, the Cloud Management app for Microsoft Teams made itself Global Administrator and added new credentials to an MSP management application and to Huntress's own application in about five minutes, though Huntress has not tied that activity to the operator behind the later sign-ins from the hosting-provider IP. A Saturday update said it had high confidence the Exchange Online, Teams and SharePoint Online Cloud Management apps were also abused. In the one tenant it reviewed closely, Huntress saw no mail or file access, but noted that Graph directory reads leave no audit trail.

ConnectWise advises administrators to check the service principal sign-ins tab in the Entra sign-in logs for the backup app, look for sources outside expected Microsoft and Azure ranges, review new app credentials, permission or consent changes and unexpected data access, and keep relevant logs, noting that an anomaly alone does not confirm compromise. Huntress recommends disabling, not deleting, the backup app and any ConnectWise or SkyKick app that cannot be verified, leaving them off until ConnectWise confirms every credential has been reset, checking all applications for credentials added since October 13 and removing unintended directory roles. It warned that disabling an app does not remove credentials already planted. Todyl said disabling stops new tokens, but issued tokens stay usable for up to 90 minutes and revoking user sessions does not end app-based access. Microsoft advises examining service principal sign-ins from unfamiliar IP addresses, changes to app credentials and OAuth grants tied to the app.