An attacker used a credential belonging to ConnectWise Cloud Backup, a Microsoft 365 backup service formerly sold as SkyKick Cloud Backup, to sign in to customers' Microsoft 365 environments, BleepingComputer reported Saturday. Security firm Huntress now counts more than 300 such environments, and ConnectWise has switched the service off while it investigates. It shows how one vendor credential can open many organizations' email, files and chats without triggering the multifactor authentication (MFA) that guards employee accounts.
Update, Oct. 19: ConnectWise's Cloud Backup, SaaS Security and Cloud Management services remained suspended Monday with no confirmed restoration time, according to the company's 9:45 a.m. EDT advisory update, so scheduled backups, archive access and restores through Cloud Backup have been unavailable since Oct. 17. On Sunday, ConnectWise added two more internet addresses, 144.172.64[.]99 and 144.172.64[.]60, to the one it first flagged. It says it has seen no successful threat activity in the environments it monitors since about 1 a.m. EDT Oct. 17 and has not identified confirmed compromise of downstream customers, while cautioning that this "is not assurance that no unauthorized activity occurred." As The Register noted Monday, managed service providers are not obliged to tell clients which platforms they use, so some businesses may not know they depend on ConnectWise.
Update, Oct. 18: In vendor research updated at 5:15 p.m. EDT Saturday, Huntress said almost 1,000 Microsoft Entra tenants had logged sign-ins from the attacker's internet address and more than 300 succeeded, up from the 162 it had confirmed earlier. It also described a separate, unsuccessful wave Oct. 15 against 16 of its customers' tenants in the policy, national security, trade and critical-minerals sectors, most of which do not use ConnectWise products. In an advisory update at 9 p.m. EDT Saturday, ConnectWise said it had disabled seven of its app identities and taken its SaaS Security and Cloud Management services offline as a precaution. The counts come from Huntress's own monitoring, and data theft, the root cause and the attacker's identity remain unconfirmed.
What Happened
The backup service is installed in each customer's Microsoft 365 "tenant," the organization's private cloud environment, as a service principal: an app identity holding whatever permissions the customer approved. It proves who it is with a credential the vendor keeps, so whoever holds that credential can act as the app in every tenant that approved it.
In vendor research published by Huntress, the firm said one internet address, 144.172.64[.]128, was used to try guessing passwords at four law firms on Oct. 13 and 14, without success, and on Oct. 15 to sign in as the backup app. The same day, related ConnectWise Cloud Management apps gave themselves administrator roles in about 50 tenants Huntress monitors. In one, the Teams management app made itself Global Administrator, the most powerful role, and added secrets to two other apps, including Huntress's own; that planted credential signed in seven times before Huntress removed it Oct. 16. Huntress has not tied that episode to the same operator.
Huntress said the narrower Oct. 15 wave, partly manual, aimed at Exchange Online, SharePoint, Teams and other Microsoft services, and failed where the ConnectWise app was not installed.
Microsoft Threat Intelligence described the incident as an active supply-chain attack, BleepingComputer reported, and said the attacker likely abused permissions the app already held.
ConnectWise said in its security advisory that it discovered the issue Oct. 14. It cut off Cloud Backup at 1:01 a.m. EDT Oct. 17, disabled the backup app and six Cloud Management connections, including those for Teams, Exchange Online and SharePoint Online, two hours later, and hired an outside incident response firm. It has not determined how the credential was exposed or whether a product flaw contributed, and has no restoration time.
Why It Matters
Because the attacker signed in as the application, MFA and user-based Conditional Access rules never applied, according to an investigation by security firm Todyl. Customers had granted it organization-wide rights over mail, files and Teams chats.
No data theft has been confirmed. ConnectWise says it has no evidence its encrypted backup archives were accessed, and its advisory notes that "a successful sign-in alone does not establish that data was copied." Todyl, however, could not tell the attacker's reads from normal backup traffic and advised treating that data as potentially exposed.
For boards, the issue is standing access held by vendors. ConnectWise says it has no visibility into downstream environments, so each organization must check its own. With backups stopped and SaaS Security offline, managed service providers have lost a monitoring tool while they hunt for planted credentials, and businesses whose providers use Cloud Backup should confirm that a second, independent backup exists. The probe of policy and national-security tenants also raises the question of whether the attacker's targets reached beyond ConnectWise's customers.
What Administrators Are Advised to Do
ConnectWise says disabling its apps "does not reverse changes previously made inside a tenant," and previously issued tokens may work until they expire. It asks partners to check their own and every managed tenant, including dormant SkyKick connections, for new app credentials, directory roles, consent grants, mail forwarding and inbox rules. Huntress advises auditing service-principal sign-ins from about 01:00 UTC Oct. 15 to 02:00 UTC Oct. 16, because some access came from Azure address space, not the known attacker address.
What to Watch
- Whether ConnectWise finds the root cause and sets a restoration date.
- Whether ConnectWise or Microsoft confirms Huntress's count of more than 300 tenants.
- Whether investigators confirm data theft or name a culprit.
- Whether organizations cut back the tenant-wide permissions they grant other vendors' apps.
