Hackers Used ConnectWise's Own Backup App to Walk Into Microsoft 365 Tenants Without Passwords or MFA

Attackers did not need anyone's password to get into hundreds of Microsoft 365 tenants last week. They had something better: the credentials of ConnectWise's Cloud Backup app, formerly SkyKick, the tool managed service providers use to back up their customers' email and files. With those, they signed in as the app itself.

No user logged in, so passwords and MFA never came into play. And the app already held broad permissions over mail, OneDrive, SharePoint and Teams in every tenant it protected. Microsoft has called it an active supply-chain attack, assessing that the attacker likely abused existing permissions including Directory.ReadWrite.All.

How far it went

Admins started talking about a possible "SkyKick/CW breach" on Friday, October 16, after spotting unauthorized access to client data. The same day, Huntress said it had found at least 162 compromised tenants in its environment.

In Microsoft 365, the backup service works through permissions granted in Entra ID, with a "service principal" representing the app inside each customer tenant. Todyl found the attacker authenticated directly as that application using its secret, from an automated script. The sign-ins gave the attacker "the technical ability to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats." In the nine tenants Todyl analyzed, though, it saw only sign-ins, with no sign the attacker created accounts, added permissions, changed passwords or set up persistence.

Huntress saw worse. On nearly 50 tenants it monitors, service principals for ConnectWise's Cloud Management apps assigned themselves directory roles, mostly Exchange Administrator. In one tenant, the attacker dug in within about five minutes: the Cloud Management Teams app granted itself Global Administrator and added credentials to an MSP management tool and to Huntress's own application, according to the company's write-up. One admin on Reddit said Microsoft's Privileged Identity Management flagged a SkyKick service principal giving itself Exchange Administrator on October 15, in a tenant that had not used the app in years.

Microsoft also observed a backdoor planted after successful sign-ins, followed by "Microsoft Graph API reconnaissance and attempts to add additional credentials." All three companies traced the activity to the same IP address, 144.172.64[.]128. Huntress tied it to scripted curl sign-in attempts on October 13 and 14. No one has attributed the attack to a group.

ConnectWise pulls the plug

ConnectWise says its monitoring caught the issue on October 14. At 07:00 UTC on October 17 it disabled seven application identities and suspended Cloud Backup by revoking certificates for affected connections across all users. It also took SaaS Security and Cloud Management offline for now.

Scheduled backups are not running and restores are unavailable. Existing archives remain encrypted, isolated and preserved, and ConnectWise says it has no evidence they were accessed. How the credential was exposed is still under analysis, and the company has not said whether a product vulnerability played a part.

The company is also candid about what it cannot see. "Since implementing these mitigations, we have not observed successful threat activity in the environments we monitor," it said. "This finding does not establish the status of downstream customer environments, which, by design, we cannot directly observe."

The cleanup is on the customers

Shutting down the connections stops new sign-ins, but "it does not reverse changes previously made inside a tenant," ConnectWise warned, and "previously issued access tokens may remain usable until they expire or are otherwise invalidated." Any credential the attacker planted is still there.

ConnectWise tells admins to check service principal sign-ins in Entra, filtered by the Cloud Backup application ID, for unexpected source addresses. Microsoft recommends reviewing app credential changes, OAuth grants and related Graph activity. Huntress advises disabling the implicated ConnectWise apps, checking app credentials for additions, and reviewing other Cloud Management integrations, which older tenants may list as "SkyKick Cloud Manager."

It is the second time in days that one service's stored secrets became everyone else's problem, after attackers ran up charges on AI API keys stored in OpenCode. Here, the keys opened the businesses themselves.

Some offers on this page may be paid placements or contain affiliate links.