**ConnectWise** has temporarily shut down customer access to its Cloud Backup service (formerly **SkyKick Cloud Backup**) following a supply-chain attack that compromised application identities and led to unauthorized access within **Microsoft 365** tenants. Reports of malicious activity surfaced on Friday, with administrators observing unauthorized access to client data. Managed cybersecurity platform **Huntress** later confirmed the concerns, identifying at least 162 compromised tenants within its monitored environments. **Microsoft** also corroborated the incident, stating it detected unauthorized authentication attempts from a specific IP address on October 15. ### Understanding the Vulnerability **ConnectWise**'s cloud backup solutions are crucial for Managed Service Providers (**MSPs**) and IT teams, protecting and restoring customer data across cloud platforms like **Microsoft 365** and **Google Workspace**. For **Microsoft 365** backups, the service relies on permissions granted via **Microsoft Entra ID**. An application identity, known as a “service principal,” represents the software within a customer’s tenant, enabling it to access resources according to its granted permissions. ### Microsoft 365 Tenant Breaches In a [security advisory](https://www.connectwise.com/company/trust/advisories), **ConnectWise** acknowledged **“unauthorized access to application identities within the ConnectWise Cloud Backup environment”** and promptly suspended application access for partners and clients. The company stated that it has **“no indicators to date that Cloud Backup partner backup data has been compromised”** and that existing archives remain secure. Investigations by **Microsoft**, **Huntress**, and other administrators pinpointed the malicious activity starting around October 15 from the IP address `144.172.64[.]128`. A **Reddit** user reported receiving a **Microsoft Privileged Identity Management (PIM)** notification on October 15, alerting them that a **SkyKick** service principal had assigned itself the role of Exchange Administrator, despite the application not being in use for years. Cybersecurity platform **Todyl** noted that attackers authenticated directly to **Microsoft 365** using the backup application's secret, thereby inheriting all previously granted customer permissions. These sign-in requests were automated scripts, making multi-factor authentication (**MFA**) ineffective. **“Because the application already held broad, previously granted permissions in each tenant, those sign-ins gave the attacker the technical ability to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats,”** **Todyl** explained. While **Todyl**'s analysis of nine intrusions found only sign-in activity and no evidence of account creation, permission changes, or password alterations, the potential for data exfiltration was significant. ### Reconnaissance and Persistence Attempts **Huntress** observed more aggressive activity across nearly 50 monitored tenants. Service principals for **ConnectWise**’s Cloud Management apps (**Exchange Online**, **Microsoft Teams**, and **Microsoft Graph**) assigned themselves directory roles, primarily Exchange Administrator. In one tenant, **Huntress** researchers documented the attacker establishing persistence within approximately five minutes. During this period, the Cloud Management - MS Teams application (`24205314-2b89-4e07-a2a4-579e898a5640`) granted itself a Global Administrator role and added credentials to an **MSP** management tool and to **Huntress**'s own application. **Microsoft Threat Intelligence** characterized the incident as an active supply-chain attack, assessing that the attacker likely exploited existing permissions, including `Directory.ReadWrite.All`. ### Indicators and Tenant Checks **Huntress** identified the legitimate Cloud Backup application ID `506e08f9-6e9a-4da4-942b-a099a03644ae` being used in the attacks. Their investigation also linked the attacker's IP address (`144.172.64[.]128`) to scripted sign-in attempts on October 13 and 14, utilizing the user agent `curl/7.88.1`. Other user agents linked to the malicious activity include `python-urllib/3.12`, `python-requests/2.31`, and `python-requests/2.34.2`. **ConnectWise** advises administrators to review service principal sign-ins in **Entra**, filtering by the Cloud Backup application ID and scrutinizing unexpected source addresses. **Microsoft** recommends reviewing application credential changes, OAuth grants, and related Graph activity. **Huntress** further advises disabling implicated **ConnectWise** applications, checking application credentials for unauthorized additions, and reviewing other Cloud Management integrations. They note that older tenants might list Cloud Management apps under 'SkyKick Cloud Manager'. **Huntress** provided an extended list of application IDs for administrators to investigate: * **ConnectWise Cloud Backup** (`506e08f9-6e9a-4da4-942b-a099a03644ae`) * **ConnectWise Cloud Management** (`2399d300-6fca-4e6a-a686-399fefe75b83`) * **ConnectWise Cloud Management - MS Teams** (`24205314-2b89-4e07-a2a4-579e898a5640`) * **ConnectWise Cloud Management - Exchange Online** (`b78f6a77-d4e5-46fb-87e5-d1648bd02519`) * **ConnectWise Cloud Management - MS Graph** (`0de14c77-b9b0-4137-9360-34878a929827`) * **ConnectWise Cloud Management - Partner Center** (`412dcf96-176d-4b3a-a1b0-4981ad66971e`) * **ConnectWise Cloud Management - SharePoint Online** (`b2b55f5b-7758-4719-8d8f-88ae172e6bdb`) It's critical to understand that **ConnectWise**'s service shutdown does not automatically remove credentials already planted in customer tenants. **Huntress** stresses that admins must review secrets and certificates across all applications for unauthorized additions since October 13 and remove any suspicious entries. **Todyl** warns that while disabling an application prevents new tokens from being issued, existing tokens remain valid until expiration, and revoking user sessions does not terminate application-based access. As of the latest update, the timeline for restoring **ConnectWise**'s Cloud Backup service remains unclear, as does the full extent of data theft and the initial compromise method.