Source: BleepingComputer
ConnectWise has shut down customer access to its Cloud Backup service, formerly SkyKick Cloud Backup, after hackers gained unauthorised access to application identities inside the vendor’s environment and used them to breach Microsoft 365 tenants. Huntress has confirmed at least 162 compromised tenants in its monitoring environment, and Microsoft Threat Intelligence has characterised the incident as an active supply-chain attack. Malicious activity was tracked to a single IP address from at least 13 October, and ConnectWise announced the service interruption on 17 October.
Why multi-factor authentication did not help
The backup service relies on a service principal in Microsoft Entra ID, an application identity that holds whatever permissions each customer granted it. According to Todyl researchers, the attacker authenticated directly to Microsoft 365 as the backup application using its secret. Because no user login was involved, protections like multi-factor authentication were ineffective. The application already held broad, previously granted permissions, so those sign-ins gave the attacker the technical ability to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats.
In nearly 50 tenants Huntress monitors, service principals for ConnectWise Cloud Management apps assigned themselves directory roles, mostly Exchange Administrator, and in one tenant the attacker established persistence in around five minutes. Microsoft observed a backdoor after successful service principal authentication, followed by Microsoft Graph API reconnaissance and attempts to add additional credentials. Huntress warns that disabling an application stops new tokens being issued, but existing tokens remain valid until they expire.
What European IT teams should do now
ConnectWise recommends that administrators check service principal sign-ins in Entra, filter by the Cloud Backup application ID and examine unexpected source addresses. Huntress advises disabling the implicated ConnectWise applications, reviewing application credentials for unauthorised additions since 13 October, and checking older tenants where the apps may still be listed under SkyKick Cloud Manager. If your organisation runs Microsoft 365 alongside MSP-managed backup tooling, this incident is a reminder that OAuth grants to third-party applications are part of your attack surface and need the same lifecycle control as user accounts.
If you want help auditing third-party application permissions in your Microsoft 365 tenants, or building a review process that would catch a rogue service principal before an attacker does, contact Excello Digital at https://excello.digital/contact/. We help European organisations secure their cloud identities with an audit trail their regulators accept.