Hackers abuse ConnectWise Cloud Backup app to breach Microsoft 365 tenants

Unknown attackers have abused compromised application identities belonging to ConnectWise Cloud Backup, the managed service provider (MSP) backup product formerly known as SkyKick Cloud Backup, to sign in to customers' Microsoft 365 tenants, BleepingComputer and The Hacker News reported on October 17. ConnectWise shut down partner and customer access to the service while it investigates. Because the backup app holds broad consented access to mailboxes, OneDrive, SharePoint and Teams data, the incident puts a large number of organizations managed by MSPs at risk.

What happened

ConnectWise said it "recently identified unauthorized access to application identities within the ConnectWise Cloud Backup environment," according to BleepingComputer. The company announced the service interruption at 05:01 UTC on October 17 and gave no timeline for restoration. It said it has no indicators so far that partner backup data was compromised and that existing archives will be accessible once services return.

According to The Hacker News, security firm Huntress confirmed unauthorized sign-ins in 173 partner and customer tenants. Microsoft described the activity as an "active supply chain attack" in which the threat actor compromised a trusted OAuth app to obtain tokens across customer tenants. How the attacker obtained the vendor credential is not yet known.

Technical details

Huntress observed password spraying from the attacker IP 144.172.64[.]128 against four law firm tenants on October 13-14, with no successful user sign-ins. On October 15, between 06:13 and 08:34 UTC, the same address obtained Microsoft Graph tokens in customer tenants, moving through them in sorted GUID order a few seconds apart, which suggests a scripted target list, The Hacker News reported.

Todyl said the attacker authenticated directly as the backup application using its secret, so multi-factor authentication did not apply. Microsoft assessed that permissions such as Directory.ReadWrite.All were likely abused and reported follow-on Graph API reconnaissance and attempts to add credentials to service principals as a backdoor.

Huntress also found that in nearly 50 tenants ConnectWise Cloud Management service principals assigned themselves directory roles, mostly Exchange Administrator, BleepingComputer said. In one tenant, the "Cloud Management - MS Teams" app granted itself Global Administrator and added new client secrets to an MSP management tool and to Huntress's own application.

Who is affected

MSPs and their clients that use ConnectWise Cloud Backup or the related Cloud Management apps for Microsoft 365 are affected. The legitimate Cloud Backup application ID is 506e08f9-6e9a-4da4-942b-a099a03644ae; older tenants may list the apps as "SkyKick Cloud Manager." The full number of victims and the extent of any data theft remain unclear.

What to do

• Disable the Cloud Backup and implicated Cloud Management applications until ConnectWise confirms credentials are reset.
• In Microsoft Entra, review the Service principal sign-ins tab filtered by the app ID and look for addresses outside expected Azure ranges.
• Audit app credentials, OAuth grants and directory role assignments added since October 13, and remove unauthorized entries.
• Enable Microsoft Graph activity logs. Todyl noted that already issued tokens can remain valid for up to 90 minutes after an app is disabled and that revoking user sessions does not end application-based access.