Attackers Access Microsoft 365 Accounts Through ConnectWise Cloud Backup Compromise
ConnectWise has disabled access to its Cloud Backup service after attackers obtained application credentials and used them to breach customer Microsoft 365 tenants. Administrators reported unauthorized activity beginning October 15, and Huntress identified at least 162 compromised tenants. Microsoft confirmed unauthorized authentication attempts from a single IP address on October 15. The attacker authenticated as the backup application using stolen secrets, bypassing user-level security controls. ConnectWise announced the service interruption on October 17 and stated it has found no evidence that stored backup data was compromised. The method used to obtain the credentials remains undisclosed.
How Attackers Gained Access
ConnectWise Cloud Backup connects to customer Microsoft 365 tenants through a service principal in Microsoft Entra ID. This application identity holds permissions to access emails, files and other resources. The attacker obtained the secret for that service principal and used it to authenticate directly to Microsoft 365 as the backup application.
According to Todyl, the sign-in requests were performed by an automated script. Because the authentication did not involve a user account, multi-factor authentication did not block the access. The application already held permissions that customers had granted, including the ability to read and write mail, OneDrive and SharePoint files, and Teams chats.
Timeline of the Incident
Huntress found evidence of scripted sign-in attempts from IP address 144.172.64[.]128 on October 13 and 14, using the user agent curl/7.88.1. On October 15, administrators observed unauthorized logins and Microsoft detected authentication attempts from the same IP address. Huntress later confirmed at least 162 compromised tenants in its monitored environments.
In nearly 50 tenants, service principals for ConnectWise Cloud Management apps assigned themselves directory roles, mostly Exchange Administrator. ConnectWise announced the backup service interruption at 05:01 UTC on October 17. The vendor has not provided a timeline for restoring access.
Persistence and Privilege Escalation
In at least one tenant, Huntress observed the attacker establishing persistence in approximately five minutes. The Cloud Management application granted itself a Global Administrator role and added credentials to other applications. Microsoft also observed reconnaissance through the Microsoft Graph API and attempts to add additional credentials after successful authentication.
Todyl analyzed nine tenants and found only sign-in activity with no evidence of account creation, password changes or persistence. Microsoft characterized the incident as an active supply-chain attack and assessed that the attacker likely abused existing permissions, including Directory.ReadWrite.All.
Vendor Response and Service Status
ConnectWise shut down partner and client access to its Cloud Backup application and launched an investigation. The vendor stated it has no indicators that stored backup data was compromised and that existing archives will be accessible once services are restored. ConnectWise has not disclosed how the attacker obtained the application secrets.
The shutdown prevents new authentication attempts but does not remove credentials the attacker may have planted in customer tenants. According to Todyl, disabling an application stops new tokens from being issued, but existing tokens remain valid until they expire. Revoking user sessions does not end application-based access.
Checking for Compromise
Administrators can review service-principal sign-ins in Microsoft Entra ID and filter by the Cloud Backup application ID 506e08f9-6e9a-4da4-942b-a099a03644ae. Look for sign-ins from IP address 144.172.64[.]128 or user agents including python-urllib/3.12, python-requests/2.31 and python-requests/2.34.2.
ConnectWise recommends examining unexpected source addresses in service principal sign-ins. Microsoft advises reviewing application credential changes, OAuth grants and related Graph activity. Huntress provides a list of seven ConnectWise application IDs to check, noting that older tenants may list Cloud Management apps under SkyKick Cloud Manager.
- Filter service-principal sign-ins in Entra by the Cloud Backup application ID 506e08f9-6e9a-4da4-942b-a099a03644ae
- Review application credentials for secrets or certificates added since October 13
- Disable the implicated ConnectWise Cloud Management and Cloud Backup applications
- Remove any unauthorized credentials and revoke existing access tokens
Supply-Chain Attack Implications
The attacker likely abused permissions including Directory.ReadWrite.All, which allows an application to read and modify directory objects. When a customer grants these permissions, the application can perform actions without further user consent. If the vendor's credential storage is compromised, every customer tenant that granted permissions becomes accessible.
The attack did not require breaching each customer individually or exploiting a vulnerability in Microsoft 365. At the time of reporting, the victim count and the extent of data theft remain unclear. ConnectWise has not stated when services will be restored.
Questions readers ask
How did the attacker access tenants without user passwords?
The attacker obtained the secret for ConnectWise Cloud Backup's service principal, which is an application identity that customers had authorized to access their Microsoft 365 data. By authenticating as the application, the attacker bypassed user-level protections.
Does disabling ConnectWise services remove the attacker from my tenant?
No. The shutdown prevents new authentication attempts but does not remove credentials the attacker may have added or revoke existing access tokens. Administrators must manually review and remove unauthorized application secrets and certificates.
Which ConnectWise applications should I check?
Review all ConnectWise Cloud Management and Cloud Backup applications. Huntress published a list of seven application IDs to check, with Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae) being the primary concern. Older tenants may see listings under SkyKick Cloud Manager.
Has ConnectWise disclosed how the credentials were stolen?
No. ConnectWise has not explained the method the attacker used to obtain the application secrets. The vendor stated it is conducting an investigation.
What data could the attacker access?
The permissions granted to ConnectWise Cloud Backup allowed reading and writing mail, OneDrive and SharePoint files, and Teams chats. Researchers observed sign-in activity and privilege escalation in some tenants, but the full extent of data accessed remains unclear.
Source and reporting limits
Based on reporting by BleepingComputer. This automated brief is not independent verification. Claims are attributed to the reporting source; later developments may change the picture.