A stolen credential for ConnectWise Cloud Backup let attackers sign in to Microsoft 365 tenants as the backup app. Security firm Huntress confirmed unauthorized access in at least 162 tenants, and ConnectWise has taken the service offline while it investigates.
The product, formerly SkyKick Cloud Backup, is used by managed service providers and IT teams to back up Microsoft 365 and Google Workspace. Microsoft calls it an active supply-chain attack.
What happened?
According to Huntress and BleepingComputer:
- The attacker got hold of the backup app's secret, a credential that lives in ConnectWise's own tenant. How is not yet known.
- They used it to sign in as the app to customers' Microsoft 365 tenants. App sign-ins don't trigger MFA.
- The app already had broad permissions, so the attacker could potentially read and write mail, OneDrive, SharePoint and Teams data. Microsoft believes they likely abused Directory.ReadWrite.All.
- Related ConnectWise Cloud Management apps were also abused. In one tenant, an app made itself Global Administrator and added new secrets to other apps, including one belonging to Huntress.
How big is it?
| Measure | Figure |
|---|---|
| Tenants with confirmed unauthorized sign-ins (Huntress, Oct 16) | 162 |
| Monitored tenants with admin-role changes | ~50 |
| Entra tenants with sign-in activity from attacker IP (Oct 17) | almost 1,000 |
| Successful sign-ins from that IP | 300+ |
Huntress also saw a second wave aimed at organizations in policy, national security, trade and critical minerals. Those attempts failed.
What has ConnectWise done?
ConnectWise shut down access on October 17, disabled seven app identities, stopped scheduled backups and took SaaS Security and Cloud Management offline. It says it has found no evidence backups were compromised. It has not given a restoration date.
What should IT admins check right now?
Based on Huntress, Microsoft and ConnectWise guidance:
- Disable (don't delete) the ConnectWise Cloud Backup app, ID
506e08f9-6e9a-4da4-942b-a099a03644ae, and related Cloud Management apps you can't verify. - Remove admin roles these apps assigned themselves, especially Global Administrator and Exchange Administrator.
- Review secrets and certificates on all enterprise apps for anything added since October 13.
- Audit service principal sign-ins from 01:00 UTC on October 15, looking for IP 144.172.64.128 and other non-Microsoft addresses.
- Review OAuth grants and Graph activity for anything unexpected.
- Remember that disabling an app stops new tokens, but existing tokens stay valid until they expire, security firm Todyl notes.
Disabling the app pauses backups only. Mail, files, Teams and sign-ins keep working.
Why does this matter beyond ConnectWise?
Backup and management tools are trusted with sweeping access to company data. One compromised vendor secret can open the door to hundreds of customers at once, and normal user protections like MFA don't apply. It's a reminder to review which third-party apps hold high-privilege access in your tenant.
