ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access
American software company ConnectWise is contending with a security incident that has allowed unknown attackers to use its application identities to break into organizations’ Microsoft 365 accounts.
The intruders used a compromised credential belonging to the ConnectWise Cloud Backup application, formerly known as SkyKick.
This spurred the company to temporarily suspend the backup service, as well as its SaaS Security (monitoring and alerting) and Cloud Management (user and license management) services, as they are integrated with Cloud Backup.
The investigation into the incident is ongoing, with the help of third-party experts.
How the service works
ConnectWise sells most of its products to managed service providers (MSPs), the outside IT firms that small and mid-sized companies hire to run/manage their technology. The company says more than 100,000 such providers use its platform, and each may look after dozens or hundreds of client organizations.
Cloud Backup, which ConnectWise acquired with SkyKick in 2024, is one of the tools MSPs use to protect those clients’ data. It keeps copies of email, OneDrive and SharePoint files, and Teams chats so they can be restored after accidental deletion or a ransomware attack.
To do that, an administrator at each client grants the software broad permissions through Microsoft Entra ID, Microsoft’s identity system. The backup app then exists in that organization’s Microsoft 365 account as an application identity (otherwise known as a “service principal”) and it can read and write data without any person signing in.
According to Huntress, the credential works in every organization that has granted the app access to its Microsoft 365 account. Whoever holds that credential can sign in as the backup service to any of those accounts and inherit the access customers had already approved.
A single compromise at the vendor therefore reached customers of many different MSPs at once, which is why Microsoft has described the incident as a supply chain attack.
What Huntress found
Huntress, a cybersecurity company that monitors SMBs for signs of intrusion, confirmed unauthorized access to at least 162 Microsoft 365 tenants.
It says the stolen credential was used on October 15, between 06:13 and 08:34 UTC, to sign in as the backup application from 144.172.64[.]128, an address belonging to a hosting provider rather than the Microsoft cloud infrastructure the app normally operates from. The same address had been used on October 13 and 14 to try guessing passwords at four law firms, without success.
The sign-ins moved through customer accounts a few seconds apart in a fixed order, which the company says points to an automated script working from a target list.
The researchers also saw other ConnectWise applications, part of its Cloud Management product, give themselves administrator roles (mostly Exchange Administrator) in roughly 50 of the organizations Huntress monitors. The software signature on those events matches the one ConnectWise’s own apps use, which suggests the company’s automation rather than the attacker (but ConnectWise has not confirmed this).
In one case, the activity was clearly hostile. Hours before the main sweep, the ConnectWise Cloud Management app for Microsoft Teams made itself a global administrator and, within about five minutes, added new credentials to two other trusted applications in that account: “an MSP management application, and Huntress’s own application (Huntress Security Platform).”
Those credentials were set to remain valid until 2028, giving whoever created them a way back in that would survive the shutdown of ConnectWise’s apps.
The activity appears to be broader than the confirmed breaches. Huntress says it found nearly 1,000 Microsoft 365 accounts with sign-in attempts from the attackers’ address, more than 300 of them successful. This activity came from Microsoft’s internal cloud network rather than the hosting provider address, and Huntress has not established that the same operator was behind both.
In a separate, more targeted wave on the same day, the same address went after 16 organizations in the policy, national security, trade and critical minerals sectors, most of which do not use ConnectWise products.
“In tenants without the relevant ConnectWise service principal, the attempts failed because the application was not present,” Huntress researchers noted. The targeting suggests the attackers were working from a list of specific organizations they wanted to get into.
What they took – if anything – is still unclear. In the one account Huntress examined in detail, it found no sign of email or file access, but it cautioned that Microsoft does not record some kinds of data reads by applications.
What ConnectWise says
ConnectWise says it discovered the problem on October 15 and has since engaged an outside forensics firm.
On October 17 it disabled seven of its application identities (the backup app, its Cloud Management product, and five apps belonging to it), revoked the certificates used for those connections and invalidated the shared Cloud Backup credentials.
But the company warns that access tokens issued before the shutdown may remain usable until they expire, and that disabling its apps does not undo changes already made inside a customer’s account. Any credentials, roles or other access the attackers created through separate identities must be found and removed by each organization.
To help with that, ConnectWise has published a technical investigation and remediation guide for MSPs, walking them through the checks to run in their own Microsoft 365 account and in every customer account they manage: the status of the affected apps, sign-in and audit records, credentials, permissions and administrator roles, as well as hidden ways back in (e.g., other compromised identities or changed mailbox settings).
The company says it cannot do this review itself, because its service has no visibility into customers’ environments. It has also asked partners who sell the service through resellers, distributors or marketplaces to make sure the guide reaches whoever actually administers each customer’s account.
Huntress gave similar advice: disable the ConnectWise apps without deleting them, check every application in the account for credentials added since October 13, and look in the service principal sign-in logs (not the default user sign-in view) for activity from the attackers’ address.
ConnectWise says its stored backups remain encrypted and isolated, and that there is no evidence they have been accessed.
Meanwhile, the disruption continues. As of October 19, the Cloud Backup, SaaS Security and Cloud Management services remain suspended. No scheduled backups are running and customers cannot restore data, and ConnectWise says it cannot yet pinpoint a restoration time.
Key questions remain unanswered, though. “The investigation identified compromised application identities. Whether a product vulnerability contributed has not been established, and the original credential-exposure mechanism remains under investigation,” the company said.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
