Attackers abuse ConnectWise Cloud Backup credential to access Microsoft 365 tenants

ConnectWise has shut off application access to its Cloud Backup service, formerly SkyKick Cloud Backup, after an unauthorised party used the application's identity to sign in to customer Microsoft 365 tenants.

Security firms Huntress and Todyl, which both published investigations, report that the attacker authenticated as the backup application itself rather than as any user. That gave the attacker the permissions customers had already granted the app, which for a Microsoft 365 backup service typically include access to mailboxes, OneDrive, SharePoint, Teams and directory data.

ConnectWise Cloud Backup is a backup and recovery service sold mainly through managed service providers (MSPs). ConnectWise acquired the product when it bought SkyKick.

What ConnectWise has said

ConnectWise first published an advisory on 16 October, saying it was investigating attempts at unauthorised access associated with the Cloud Backup environment. In an update at 05:01 UTC on 17 October, the company said it had identified unauthorised access to application identities within the Cloud Backup environment and was shutting off Cloud Backup application access, interrupting backups for customers until further notice.

ConnectWise said it had no indicators to date that partner backup data had been compromised, and that existing backup archives would be accessible once services are restored. It said its investigation and remediation efforts were ongoing.

How the access worked

According to Huntress, a credential belonging to the ConnectWise Cloud Backup application was used to obtain Microsoft Graph access tokens in customer tenants. "The app's credential is in hostile hands," Huntress wrote.

Because the backup app is a multi-tenant application, the same credential works in every tenant where the app has been consented. Huntress said this means the attacker is not limited to the tenants confirmed so far.

Todyl said the attacker presented the app's credential using the OAuth 2.0 client credentials flow. No user was involved, so user-focused controls such as multi-factor authentication and user Conditional Access policies did not apply. Todyl said the app's existing consent permits read and write access to mail and attachments, OneDrive and SharePoint files, and Teams chats, including the ability to restore data.

Todyl also noted that revoking user sessions does not end this type of access. Disabling the app in a tenant stops new tokens being issued, but tokens already issued remain valid for up to 90 minutes.

Timeline

Huntress attributes the following activity to infrastructure at IP address 144.172.64[.]128, a hosting provider address:

• 13 to 14 October: password spraying against four law firm tenants. Huntress said it saw no successful user sign-ins from this address in its telemetry.
• 15 October, 06:13 to 08:34 UTC: the backup application's identity signed in to customer tenants from that address. Huntress said the attacker moved through tenants in sorted order a few seconds apart, pointing to a script working from a target list. Todyl recorded sign-ins in the tenants it monitors between 07:11 and 08:47 UTC.

Huntress said that, as of 19:00 UTC on 16 October, it had confirmed unauthorised sign-ins in 162 tenants. The total number of affected organisations has not been disclosed.

Microsoft also confirmed the malicious activity involving the Cloud Backup service, according to BleepingComputer, describing it as an active supply chain attack.

A second ConnectWise application

Huntress also reported activity involving a different ConnectWise application, ConnectWise Cloud Management for Microsoft Teams.

In one customer tenant, between 03:44 and 03:49 UTC on 15 October, that application added itself to the Global Administrator role. A script then added new client secrets to two other applications in the tenant: an MSP management application and Huntress's own security platform application. Adding credentials to an existing application gives whoever holds them the ability to sign in as that application, with its existing permissions, without a user or MFA.

Huntress separately observed ConnectWise Cloud Management applications assigning themselves directory roles, mostly Exchange Administrator, in roughly 50 tenants it monitors from 01:58 UTC on 15 October. Huntress said the user agent on those events matches the one ConnectWise's own applications use, which points to vendor automation, but that it had not confirmed this with ConnectWise.

Huntress said it has no source address for the activity that preceded 06:13 UTC and has not tied it to the same operator as the sign-ins from 144.172.64[.]128.

Todyl, in the tenants it monitors, found no directory changes tied to the activity: no new secrets, applications, consents or role assignments by the backup app.

What is not known

Several key questions remain unanswered at the time of writing:

• How the credential was obtained. Neither ConnectWise nor the researchers have said how the attacker got the application credential.
• Whether data was taken. Huntress said that in the one tenant audit log it reviewed in detail, it saw no mail or file access, but that directory reads through Microsoft Graph leave no audit trail. Todyl said that in tenants with an active backup subscription, read activity cannot be attributed to either the attacker or the legitimate backup service, because both use the same application identity. Todyl recommended that affected organisations treat their data as exposed.
• Who is responsible. No researcher or vendor has attributed the activity to a named threat actor.
• When service will resume. ConnectWise has not given a timeline for restoring Cloud Backup access.

What administrators should check

The researchers and ConnectWise recommend the following for any Microsoft 365 tenant where ConnectWise Cloud Backup or SkyKick has ever been deployed:

• Disable, do not delete, the backup application. In the Microsoft Entra admin center, go to Enterprise applications, find application ID 506e08f9-6e9a-4da4-942b-a099a03644ae (it may appear as "ConnectWise Cloud Backup" or "SkyKick Backup") and set sign-in to disabled. Huntress advises against deleting it, because that removes the consent and would require re-consent to restore service. Disabling pauses new backups, but Huntress said existing backups held by ConnectWise are not deleted.
• Check other ConnectWise and SkyKick applications. Huntress lists the following application IDs, and notes older tenants may show the Cloud Management apps as "SkyKick Cloud Manager":
  • ConnectWise Cloud Management: 2399d300-6fca-4e6a-a686-399fefe75b83
  • ConnectWise Cloud Management - MS Teams: 24205314-2b89-4e07-a2a4-579e898a5640
  • ConnectWise Cloud Management - Exchange Online: b78f6a77-d4e5-46fb-87e5-d1648bd02519
  • ConnectWise Cloud Management - MS Graph: 0de14c77-b9b0-4137-9360-34878a929827
  • ConnectWise Cloud Management - Partner Center: 412dcf96-176d-4b3a-a1b0-4981ad66971e
  • ConnectWise Cloud Management - SharePoint Online: b2b55f5b-7758-4719-8d8f-88ae172e6bdb
• Review service principal sign-ins. Under Monitoring, Sign-in logs, open the Service principal sign-ins tab (the default User sign-ins tab will not show this activity), filter by the backup application ID, and look for addresses outside Microsoft and Azure ranges, including 144.172.64[.]128. Huntress noted that a clean result does not rule out access.
• Review credentials on all applications. Check client secrets and certificates on every Enterprise application and App registration, particularly management and security tools, for any added since 13 October that your organisation did not create.
• Remove unexpected roles. If a ConnectWise or SkyKick application holds a directory role you did not intentionally grant, such as Global Administrator, remove it after disabling the app.
• Do not re-enable the applications until ConnectWise confirms all credentials have been reset.
• Preserve and extend logging. Todyl recommended exporting logs now for tenants on Entra ID Free, which has seven-day retention, and enabling Microsoft Graph activity logs, which require Entra ID P1 or P2 and do not apply retroactively.

ConnectWise, Huntress and Todyl have all said their investigations are ongoing. This article will be updated if material new information is confirmed.