ConnectWise suspended partner and customer access to its Cloud Backup service, formerly known as SkyKick Cloud Backup, after discovering unauthorized access to application identities that were used to breach Microsoft 365 tenants. Microsoft described the incident as an active supply chain attack, while Huntress said it identified at least 162 compromised tenants within its environment.
Indicators of activity began appearing on October 15, and Microsoft, Huntress, and Todyl tracked login attempts to a single IP address: 144.172.64[.]128. Microsoft confirmed that ConnectWise Cloud Backup experienced unauthorized authentication attempts, while ConnectWise said it had shut down application access to its systems and begun investigating and remediating the issue.
How were backup permissions exploited?
The Microsoft 365 backup service relies on permissions granted through Microsoft Entra ID, where an application identity known as a service principal represents the software within the customer’s tenant. According to Todyl researchers, the attacker authenticated directly using the application secret, taking advantage of permissions that customers had previously granted to the service.
The process did not require a user login, so multifactor authentication was not sufficient to prevent it. The broad permissions technically enabled the reading and writing of email and attachments, OneDrive and SharePoint files, and Teams chats. In nine cases examined by Todyl, the company found no evidence of account creation, password changes, or the establishment of persistence through the backup application.
Persistence attempts and administrative permissions
Huntress observed that, in approximately 50 tenants, the ConnectWise Cloud Management applications for Exchange Online, Microsoft Teams, and Microsoft Graph granted themselves directory roles, most notably the Exchange Administrator role. In one case, the Cloud Management - MS Teams application granted itself the Global Administrator role and added credentials to an IT service provider management tool and to a Huntress application.
Microsoft also observed background activity after the application identity authenticated, followed by reconnaissance through Microsoft Graph and attempts to add new credentials. Microsoft indicates that the attacker may have exploited existing permissions, including Directory.ReadWrite.All.
What should Microsoft 365 administrators review?
ConnectWise recommends examining service principal sign-in logs in Entra, filtering the results using the Cloud Backup application ID, and then reviewing unexpected source addresses. Microsoft also recommends reviewing application credential changes, OAuth grants, and associated Graph activity.
Huntress warns that disabling the affected applications does not necessarily remove credentials that were previously added to the tenant. Therefore, secrets and certificates in all applications should be examined for unauthorized additions made since October 13. Todyl notes that disabling the application prevents the issuance of new tokens, but does not invalidate existing tokens until they expire; revoking user sessions also does not stop application-based access.
Huntress identified the legitimate Cloud Backup application ID: 506e08f9-6e9a-4da4-942b-a099a03644ae, along with IDs for other Cloud Management applications. It also linked the activity to user agents such as curl/7.88.1, python-urllib/3.12, python-requests/2.31, and python-requests/2.34.2.
The scope of the damage remains unclear
ConnectWise said there are currently no indications that stored backup data was compromised, and that existing archives will remain available after service is restored. However, the final number of victims, the volume of data that may have been stolen, and how the attacker obtained the supplier’s credentials have not yet been determined. Suspending the service alone is also insufficient to address the effects of the breach inside tenants to which new secrets, certificates, or permissions may have been added.