ConnectWise announced the suspension of a number of its core cloud services, including Cloud Backup, SaaS Security, and Cloud Management, following the detection of unsafe activity involving attackers exploiting compromised credentials to access customer environments on the Microsoft 365 platform.
Sequence of events and affected services
The crisis began when the company detected unauthorized activity within the cloud backup environment, prompting it to shut down the service—formerly known as SkyKick—on October 17, about 12 hours after investigations began. As the scope of the investigation widened, the company decided the next day to preemptively halt SaaS Security and Cloud Management services to implement protective measures and mitigate potential impacts.
This precautionary action disrupted backup schedules, archive access, and recovery operations, as well as affecting SaaS Security monitoring and alerts, and user and license management. The company has not yet provided a precise timeline for the full restoration of services, but it has published technical guidance to help Managed Service Providers (MSPs) review and secure their environments.
Nature of the breach and the role of Huntress
Meanwhile, cybersecurity firm Huntress explained that the compromised backup credentials were used to access Microsoft 365 tenants starting in mid-October. Technical analyses indicated that the credential type was a client assertion, meaning the credential existed within the provider's own environment rather than as a result of any action by the customers.
Huntress detected activity from an Internet Protocol (IP) address used in password-spraying attacks against law firms, where attackers infiltrated via scripts targeting specific lists in Entra environments. Although some login attempts succeeded, the firm confirmed that actual access required the presence of the ConnectWise service principal within the targeted tenant.
What changes practically?
Business owners and IT administrators face the heavy responsibility of verifying that the threat actor has not altered Microsoft 365 settings or created persistence mechanisms within their tenants. According to cybersecurity experts, some IT administrators mistakenly believe that Microsoft automatically backs up configuration settings, making recovery from such attacks complex and requiring thorough manual auditing by security teams.