ConnectWise Shuts Down Cloud Backup After M365 Breach
ConnectWise has suspended customer access to its Cloud Backup service after threat actors leveraged application identities to breach multiple Microsoft 365 tenants.
Radwan AbdulhadiEditor and technology writer
ConnectWise Suspends Cloud Backup Access
ConnectWise has shut down customer access to its Cloud Backup service, formerly known as SkyKick Cloud Backup, following a supply-chain incident that resulted in compromised Microsoft 365 tenants. Reports of malicious activity began emerging when administrators observed unauthorized access to client data.
In response to the incident, ConnectWise released a formal security advisory detailing that it had identified unauthorized access to application identities within its Cloud Backup environment. The company subsequently disabled application access for its partners and clients.
Scope and Attribution of the Attack
Managed cybersecurity and threat detection platform Huntress confirmed the compromise, reporting that it had identified at least 162 affected tenants within its environment. Meanwhile, Microsoft confirmed malicious activity involving the backup service and noted unauthorized authentication attempts originating from a specific IP address.
According to investigations conducted by Microsoft, Huntress, and Todyl, the malicious operations began on October 15 utilizing the IP address 144.172.64[.]128. One administrator on Reddit reported receiving Microsoft Privileged Identity Management alerts indicating that a SkyKick service principal had assigned itself the Exchange Administrator role.
Mechanisms of the Microsoft 365 Compromise
Cloud backup solutions for Microsoft 365 rely on permissions granted through Microsoft Entra ID via a service principal application identity. Researchers at Todyl explained that attackers authenticated directly to Microsoft 365 as the backup application using its secret.
Because these automated requests did not involve a user login, standard multi-factor authentication protections were ineffective. The application's broad pre-existing permissions granted attackers the technical capability to access mail, attachments, SharePoint files, OneDrive data, and Teams chats.
Observed Persistence and Threat Intelligence
While Todyl researchers primarily observed sign-in activity without detecting account creation or modified passwords across analyzed intrusions, Huntress observed directory roles assigning themselves and persistence mechanisms being established in multiple tenants.
Huntress saw that service principals for ConnectWise Cloud Management applications assigned themselves directory roles like Exchange Administrator. In certain instances, threat actors established backdoors and added credentials to management tools within minutes.
Microsoft Threat Intelligence also tracked similar persistence activity, noting backdoors following successful authentication alongside Microsoft Graph API reconnaissance attempts.
Remediation and Recommendations for Administrators
ConnectWise stated that it has no indicators showing partner backup data was compromised and confirmed that existing cloud backup archives remain intact and will become accessible once services are restored. However, vendor shutdowns do not automatically remove credentials already planted in customer tenants.
Cybersecurity providers recommend that IT administrators review service principal sign-ins in Microsoft Entra, check application credentials and OAuth grants for unauthorized additions since October 13, and inspect relevant Cloud Management integrations.
Sources
- BleepingComputerHackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
Continue chronologically
Related entity coverage
Related stories
China-Aligned Hackers Deploy AI Agents in ConnectWise Attack
Microsoft reveals China-state-aligned hackers used AI agents in a massive ConnectWise supply chain attack targeting thousands of Microsoft 365 tenants.
Chainalysis Discloses Data Breach From Offensive Agentic Techniques
Blockchain intelligence firm Chainalysis discloses a security breach involving offensive agentic techniques that exposed customer names and emails.
Microsoft 365 Family Plan Drops to Shared 2TB Storage
Microsoft changes its 365 Family plan storage model from 1TB per member to a shared 2TB space, while keeping the pricing at $13 a month.
Unpatched AhsayCBS Flaws Exploited for Webshells
Threat actors are actively exploiting unpatched critical and medium-severity vulnerabilities in the AhsayCBS backup management platform.
