ConnectWise has suspended customer access to its Cloud Backup service following a compromise of application identities that allowed threat actors to infiltrate Microsoft 365 tenants. The incident came to light on Friday when system administrators began reporting unauthorized access to data within their Microsoft 365 environments tied to what appeared to be a breach of the SkyKick/ConnectWise infrastructure.

Huntress, a managed cybersecurity and threat detection platform, corroborated the reports the same day, confirming it had detected at least 162 compromised tenants across its customer base. Microsoft subsequently acknowledged the malicious activity, disclosing that it had observed unauthorized authentication attempts originating from a single IP address on October 15.

ConnectWise's Cloud Backup offering—previously branded as SkyKick Cloud Backup—delivers backup and recovery capabilities to managed service providers and IT teams, protecting data such as emails and files stored in Microsoft 365, Google Workspace, and other cloud platforms. The service integrates with Microsoft 365 through service principals, application identities that hold permissions to access customer resources within their Microsoft Entra ID tenants.

Unauthorized Access and Initial Response

ConnectWise disclosed in a security advisory that it had "recently identified unauthorized access to application identities within the ConnectWise Cloud Backup environment" and immediately revoked application access for its partners and clients. The company stated, "We have no indicators to date that Cloud Backup partner backup data has been compromised. The existing cloud backup archive is not impacted by this service interruption and will be accessible once services are restored."

The company is currently conducting an investigation and executing remediation procedures. Evidence from Microsoft, Huntress, and system administrators indicates the attack originated from IP address 144.172.64[.]128 beginning at least on October 15.

One administrator reported receiving a notification from Microsoft's Privileged Identity Management service on October 15 indicating that a SkyKick service principal had assigned itself the Exchange Administrator role, despite the organization having discontinued use of the application years prior.

Attack Method and Scope

According to Todyl, a cybersecurity platform serving MSPs and IT professionals, the attacker authenticated directly to Microsoft 365 using the backup application's secret, leveraging permissions that customers had previously granted. An automated script executed the sign-in requests without user involvement, rendering multi-factor authentication protections ineffective.

Todyl explained the implications: "Because the application already held broad, previously granted permissions in each tenant, those sign-ins gave the attacker the technical ability to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats." In nine analyzed intrusions, Todyl researchers found only sign-in activity with no evidence of account creation, permission escalation, password changes, or persistence mechanisms deployed through the backup application.

Reconnaissance and Persistence Attempts

Huntress observed a different pattern across nearly 50 monitored tenants, where service principals associated with ConnectWise's Cloud Management applications—covering Exchange Online, Microsoft Teams, and Microsoft Graph—granted themselves directory roles, predominantly Exchange Administrator. In at least one tenant, the attacker successfully established persistence in approximately five minutes.

During this activity, Cloud Management - MS Teams (24205314-2b89-4e07-a2a4-579e898a5640) elevated itself to Global Administrator and injected credentials into an MSP management tool and Huntress's own application. Microsoft also detected persistence activity involving a backdoor following successful service principal authentication, accompanied by Microsoft Graph API reconnaissance and attempts to add supplementary credentials.

All three cybersecurity firms tracked the malicious activity to the same IP address. Microsoft Threat Intelligence classified the incident as an active supply-chain attack, with the attacker likely exploiting existing permissions including Directory.ReadWrite.All.

Indicators and Remediation Guidance

Huntress identified the legitimate Cloud Backup application ID 506e08f9-6e9a-4da4-942b-a099a03644ae as the vector for attacks. The investigation linked the attacker IP to scripted sign-in attempts on October 13 and 14 using the user agent curl/7.88.1. At least three user agents have been associated with the malicious Cloud Backup activity: python-urllib/3.12, python-requests/2.31, and python-requests/2.34.2.

ConnectWise advises administrators to examine service principal sign-ins in Entra, filter by the Cloud Backup application ID, and investigate unexpected source IP addresses. Microsoft recommends reviewing application credential modifications, OAuth grants, and associated Graph activity.

Huntress recommends disabling the affected ConnectWise applications, auditing application credentials for unauthorized additions, and reviewing other Cloud Management integrations. Administrators should note that older tenants may reference Cloud Management apps under the legacy name 'SkyKick Cloud Manager.'

Huntress has compiled a list of application IDs for administrators to monitor:

  • ConnectWise Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae)
  • ConnectWise Cloud Management (2399d300-6fca-4e6a-a686-399fefe75b83)
  • ConnectWise Cloud Management - MS Teams (24205314-2b89-4e07-a2a4-579e898a5640)
  • ConnectWise Cloud Management - Exchange Online (b78f6a77-d4e5-46fb-87e5-d1648bd02519)
  • ConnectWise Cloud Management - MS Graph (0de14c77-b9b0-4137-9360-34878a929827)
  • ConnectWise Cloud Management - Partner Center (412dcf96-176d-4b3a-a1b0-4981ad66971e)
  • ConnectWise Cloud Management - SharePoint Online (b2b55f5b-7758-4719-8d8f-88ae172e6bdb)

Shutting down the service does not eliminate credentials already deployed in customer tenants. Huntress emphasizes that administrators must review secrets and certificates across all applications for unauthorized entries added since October 13 and delete those credentials. Todyl cautions that disabling an application prevents new token issuance but leaves existing tokens valid until expiration, and revoking user sessions does not terminate application-based access.

ConnectWise announced the backup service interruption at 05:01 UTC on October 17 without providing a restoration timeline. The company has not reported evidence that stored backups were compromised and stated that existing archives will become accessible once services resume.

As of publication, the total number of affected victims and the extent of any data exfiltration remain undetermined. The method by which the attacker obtained the vendor's credentials has also not been disclosed.