ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs

Researchers say attackers authenticated into Microsoft 365 tenants using ConnectWise credentials; ConnectWise says customer impact remains unconfirmed.

A threat actor used credentials associated with ConnectWise's Cloud Backup product to authenticate into Microsoft 365 tenants, according to multiple security firms, though the extent of downstream compromise remains unclear.

First, on Oct. 16 and then throughout the weekend, ConnectWise shared details involving a possible supply chain incident and its product, ConnectWise Cloud Backup (formerly known as SkyKick). The software vendor, which primarily serves managed service providers (MSPs), said in its disclosure status post that it identified "unauthorized access to application identities associated with ConnectWise Cloud Backup" on Oct. 14, and that its investigation remains ongoing. In response to the incident, the company on Oct. 17 then disabled Cloud Backup for partners and clients, and over the weekend it also disabled SaaS Security and Cloud Management as the investigation and remediation efforts continue. Backups, restores, SaaS Security monitoring, and Cloud Management functions remain unavailable. ConnectWise said it also engaged an incident response firm. So far, the company hasn't confirmed any vulnerability exploitation as part of the attack chain.

The caution is warranted: ConnectWise Cloud Backup is a software-as-a-service (SaaS) backup product for Microsoft 365 data, which therefore requires customer organizations grant extensive permissions inside their 365 and Entra environments. The product generally is able to access Exchange mailboxes, OneDrive, SharePoint, Teams, and other sensitive workloads tied to the enterprise platform.

ConnectWise, Researchers Split on Blast Radius

Official details of the incident remain sparse. The original credential exposure mechanism remains under investigation, and ConnectWise has not attributed the breach to a specific attacker.

However, the company said it revoked certificates used by affected application connections and that the affected shared Cloud Backup credentials are no longer valid. It has also rotated credentials or disabled compromised identities identified as associated with the incident to date.

The status post includes indicators of compromise (IoCs) for customers; the company recommends customers review their own Microsoft 365 tenant and each managed customer tenant, including those with dormant SkyKick connections.

One unusual aspect of this incident is the discrepancy between the reporting of ConnectWise and third-party researchers, particularly regarding downstream impact. As of this writing, ConnectWise's disclosure post says downstream impact remains under investigation: "We have not identified confirmed downstream customer compromise."

The apparent disconnect may stem from how each party defines compromise. ConnectWise has repeatedly stated that it lacks independent visibility into customer Microsoft 365 environments and therefore cannot determine whether individual tenants experienced unauthorized activity.

"Our findings about stored archives are separate from potential activity in live Microsoft 365 environments," the blog post said. "Cloud Backup does not provide the downstream security visibility needed for us to determine independently whether a particular partner or customer tenant experienced unauthorized activity."

By contrast, security firms Huntress and Todyl argued in respective security blog posts that successful authentication into customer tenants using the ConnectWise application's credentials itself constitutes downstream impact, regardless of whether data access can be proven. Thus, ConnectWise does not explicitly disagree with either vendor's findings, but instead positions its messaging more cautiously.

Third-Party Researchers Assert Downstream Impact Occurred

On Oct. 16, Huntress's Jonathan Semon wrote in a blog post that a Microsoft 365 credential, specifically an API secret, belonging to ConnectWise Cloud Backup has been compromised. "Huntress has high confidence that the threat actor abused ConnectWise Cloud Management applications for Exchange Online, Microsoft Teams, and SharePoint Online, Cloud Backup, MS Graph, and Partner Center," Semon wrote.

Across two waves of activity, Semon said Huntress identified sign-in activity associated with more than 1,000 Entra tenants with sign-in activity from the IP address linked to the unauthorized activity (144.172.64[.]128), and "over 300 of those succeeded."

Semon tells Dark Reading that Huntress first saw broad sweeps across many organizations, followed by "a smaller, apparently more manual sweep of organizations in the policy, national security, trade, and critical mineral sectors, which was unsuccessful."

And in two tenants, Huntress saw a ConnectWise application give itself the highest level of access in a Microsoft 365 application (Global Administrator) then add credentials for other applications so the attacker would have a way back in that doesn't rely on the original ConnectWise key. "It's why we're recommending that organizations review credentials and administrator roles, and not only disable the affected apps," Semon says.

Huntress's core message is to assume the affected ConnectWise apps are unsafe until proven otherwise, and to look for persistence. Customers should confirm data retention and restore options with ConnectWise and manually check credentials for signs of compromise.

Broad Tenant Compromise Appears to Be a Real Concern

While Huntress said the credential works against every tenant where the app is consented and recommends disabling it (as mentioned, ConnectWise has disabled affected apps until further notice), Todyl explicitly tells customers to presume compromise. "We can assume ALL tenants that have 506e08f9-6e9a-4da4-942b-a099a03644ae [the Microsoft Entra application ID for the ConnectWise Cloud Backup application, formerly SkyKick Backup] enabled are compromised," Nicholas Koken wrote.

A spokesperson for Todyl tells Dark Reading that the most concerning aspect of this incident is that "the actor accessed SkyKick partner tenants in strict tenant-ID order, including tenants where the app had never been installed."

This, according to Todyl, is a very significant detail. "This indicates the actor held a pre-built list of SkyKick partner tenants, most likely sourced from vendor-side records," the spokesperson explains. "ConnectWise has not yet disclosed whether partner data, including tenant lists, was exposed."

Moreover, the spokesperson assesses that among the tenants Todyl monitors, the activity, which is targeted specifically to MSPs, appears to be reconnaissance, and to check whether stolen credentials work.

In a statement shared this morning, ConnectWise reiterated, "Since implementing our mitigations, we have not observed successful threat activity in the environments we monitor."

"We have no indicators to date that Cloud Backup partner backup data has been compromised," ConnectWise says. "We have remediated identified compromised credentials and identities, and we continue authentication monitoring, permission review, and forensic analysis."

Regardless of whether or not it's true that all data with the application ID should be assumed compromised, the general advice between the two third-party security firms are similar: Make sure relevant applications are disabled, check indicators of compromise, and work with ConnectWise as needed.

Dark Reading contacted Microsoft for comment, but the company did not respond at press time.