ConnectWise Cloud Backup breach hits Microsoft 365 tenants

BleepingComputer reports that ConnectWise has shut down customer access to its Cloud Backup service after attackers accessed application identities and used them to sign in to Microsoft 365 tenants. Microsoft, Huntress, and other responders linked the activity to a single IP address and to scripted sign-in attempts that began at least on October 15.

What happened

According to BleepingComputer, Microsoft confirmed unauthorized authentication attempts arriving from an IP address on October 15, and Huntress reported at least 162 compromised tenants in its environment. ConnectWise said it "recently identified unauthorized access to application identities within the ConnectWise Cloud Backup environment," and it cut application access for partners and clients while it investigates.

The Cloud Backup service uses application identities, called service principals in Microsoft Entra ID, to act inside customer tenants with the permissions those tenants granted. Todyl researchers found the attacker authenticated directly to Microsoft 365 using a backup application secret, and the sign-ins were automated, so multi-factor authentication did not block them. Because the application already had broad permissions, the attacker had the technical ability to read and write mail, OneDrive and SharePoint files, and Teams chats, BleepingComputer reports.

How the attack worked, as investigators saw it

• Multiple security firms and administrators traced activity to the same IP address, 144.172.64[.]128, and to scripted requests that used user agents such as curl and python-requests.
• Todyl looked at nine tenants and saw sign-in activity by the backup app but did not find evidence in those samples that the attacker created accounts or changed passwords using the backup app.
• Huntress observed that in roughly 50 tenants the ConnectWise Cloud Management service principals assigned themselves directory roles, mostly Exchange Administrator, and in at least one tenant the attacker elevated a service principal to Global Administrator and added credentials to an MSP tool.
• Microsoft Threat Intelligence assessed the incident as an active supply-chain attack where the threat actor likely abused existing permissions, including Directory.ReadWrite.All.

Investigators have published application IDs to help admins find the implicated apps. Huntress identified the Cloud Backup application ID 506e08f9-6e9a-4da4-942b-a099a03644ae, and other related ConnectWise Cloud Management IDs are also listed by responders.

What this means for small organizations and IT teams

This incident shows how third-party backup or management apps with standing permissions can be used by attackers if the vendor environment or app credentials are compromised. Because those apps sign in without a user, controls like user MFA do not stop them. Even if a vendor suspends its service, existing tokens or secrets already issued to the app remain valid until they expire, and revoking user sessions does not end application-based access.

At the time of the reports, ConnectWise said it had no indicators that stored backup archives were compromised and that existing archives would be accessible once services are restored, but the company is investigating and remediating the issue, BleepingComputer reports.

Practical steps for administrators (what to do now)

• Check service principal sign-ins in Microsoft Entra ID, filter by the Cloud Backup application ID and by unexpected source addresses, as recommended by ConnectWise.
• Review application credential changes, OAuth grants, and Microsoft Graph activity for signs of unauthorized additions or reconnaissance, as Microsoft advises.
• Disable the implicated ConnectWise applications while you investigate, and check application credentials for unauthorized additions, as Huntress recommends. Note that disabling an app stops new tokens but does not invalidate existing tokens until they expire, and revoking user sessions does not end app-based access.
• Search for the listed ConnectWise application IDs and Cloud Management IDs in your tenant and remove or rotate any secrets or certificates added since October 13.
• Look for abrupt directory role changes, such as service principals assigning themselves Exchange Administrator or Global Administrator roles, and remove unexpected role assignments and credentials.
• Monitor for persistence indicators and unusual Graph API queries, and investigate any added credentials in management tools.
• If you want a quick external check of exposure, start with a free external scan to see what an outside view reveals.

What to watch for next

Investigators have not yet published a complete tally of impacted tenants or the method the attacker used to obtain vendor credentials. BleepingComputer links findings from Microsoft, Huntress, and Todyl showing overlapping indicators, including the attacker IP, the Cloud Backup application ID, and the scripted sign-in user agents. Expect vendors and responders to release more technical indicators and remediation guidance as the investigation continues.

If your organization uses ConnectWise Cloud Backup or older SkyKick-branded Cloud Management apps, follow the checks above and coordinate with your MSP or vendor contact. The public reporting is still evolving, so keep monitoring the vendor advisory and security community updates for new indicators and recommended mitigations.

For the original reporting, see the article on BleepingComputer.