A ConnectWise supply-chain attack has compromised Microsoft 365 tenants through trusted application identities used by its cloud services. Security firm Huntress identified at least 162 affected tenants within its monitoring environment.
ConnectWise suspended customer and partner access to Cloud Backup, formerly SkyKick Cloud Backup, while investigating unauthorized access to application identities. However, the company said it had found no indicators that attackers compromised stored backup data.
Microsoft also confirmed malicious activity involving the service. The overall victim count, extent of data theft and source of the stolen credentials remain unclear.
Attackers Used Trusted Application Permissions
ConnectWise Cloud Backup uses Microsoft Entra ID application identities, known as service principals, to access customer environments. These identities allow the service to back up data using permissions customers previously approved.
According to Todyl researchers, the attacker authenticated as the backup application using its secret. As a result, the attacker inherited permissions that the application already held.
Those permissions could allow access to emails, attachments, OneDrive files, SharePoint content and Teams chats. However, the ability to access those resources does not establish that attackers stole all available data.
The activity used application authentication rather than an interactive user login. Consequently, user-focused protections such as multifactor authentication did not prevent these sign-ins.
Investigators Report Different Levels of Intrusion
Todyl examined nine tenants and found unauthorized sign-in activity. In those environments, researchers found no evidence of account creation, password changes, additional permissions or persistence through the backup application.
However, Huntress observed more extensive activity elsewhere. Across nearly 50 monitored tenants, ConnectWise Cloud Management service principals assigned themselves directory roles, most commonly Exchange Administrator.
In one tenant, attackers used the MS Teams management application to obtain Global Administrator privileges. They then added credentials to an MSP management tool and Huntress’s application, establishing continued access in approximately five minutes.
Microsoft separately reported persistence activity following successful service principal authentication. Its findings included Microsoft Graph reconnaissance and attempts to add further credentials.
These differences show that the observed impact varied between tenants.
Suspicious Activity Traces Back to October 13
Microsoft identified unauthorized authentication attempts from 144.172.64[.]128 on October 15. Huntress and Todyl linked malicious activity to the same address.
Meanwhile, Huntress found associated scripted sign-in attempts dating to October 13 and 14. Those requests used the user agent curl/7.88.1.
Researchers also identified three Python user agents associated with the activity:
python-urllib/3.12python-requests/2.31python-requests/2.34.2
Microsoft characterized the incident as an active supply-chain attack. It assessed that the attacker likely abused existing permissions, including Directory.ReadWrite.All.
Administrators Urged to Review Connected Applications
ConnectWise recommends reviewing service principal sign-in logs in Entra. Administrators should filter for the Cloud Backup application ID and investigate unexpected source addresses.
Additionally, Microsoft advises checking application credential changes, OAuth grants and related Microsoft Graph activity.
Huntress recommends disabling the implicated applications and reviewing other Cloud Management integrations. Older tenants may display these services under the name SkyKick Cloud Manager.
The applications identified for review include:
| Application | Application ID |
|---|---|
| ConnectWise Cloud Backup | 506e08f9-6e9a-4da4-942b-a099a03644ae |
| ConnectWise Cloud Management | 2399d300-6fca-4e6a-a686-399fefe75b83 |
| Cloud Management – MS Teams | 24205314-2b89-4e07-a2a4-579e898a5640 |
| Cloud Management – Exchange Online | b78f6a77-d4e5-46fb-87e5-d1648bd02519 |
| Cloud Management – MS Graph | 0de14c77-b9b0-4137-9360-34878a929827 |
| Cloud Management – Partner Center | 412dcf96-176d-4b3a-a1b0-4981ad66971e |
| Cloud Management – SharePoint Online | b2b55f5b-7758-4719-8d8f-88ae172e6bdb |
Service Shutdown Does Not Remove Existing Access
The ConnectWise supply-chain attack requires checks beyond the affected vendor applications. Shutting down the service does not remove credentials attackers may have added elsewhere in customer tenants.
Therefore, Huntress advises reviewing secrets and certificates across all applications for unauthorized additions since October 13. Administrators should remove any such entries they identify.
Todyl also warns that disabling an application prevents new tokens but does not immediately invalidate existing ones. Those tokens can remain usable until they expire, while revoking user sessions does not end application-based access.
ConnectWise announced the service interruption at 05:01 UTC on October 17 without providing a restoration timeline. The company said existing backup archives remained unaffected by the interruption and would become accessible once service resumed.
0 responses to “ConnectWise Supply-Chain Attack Breaches Microsoft 365”