The ConnectWise breach has compromised more than 300 organizations after attackers stole credentials for its Cloud Backup service. The incident exposed Microsoft 365 environments to unauthorized access, potentially putting emails, documents and directory information at risk.
Huntress detected suspicious sign-in activity across nearly 1,000 Microsoft Entra customer accounts, including more than 300 successful intrusions. However, investigators have not confirmed data theft, and the full number of affected organizations and users remains unknown.
In one investigated case, attackers also added credentials to other applications. Those credentials carried expiration dates in 2028, creating a potential route back into the environment.
Stolen Backup Credentials Opened Customer Environments
ConnectWise Cloud Backup, previously known as SkyKick, helps managed service providers back up customers’ Microsoft 365 data. Consequently, the service relies on application permissions that allow access across connected business environments.
According to Microsoft Threat Intelligence, attackers exploited permissions that customers had already granted to the trusted application. These included Directory.ReadWrite.All, which formed part of the access available through the compromised identity.
Using the stolen application credentials, the attackers obtained access tokens for customer tenants. The application’s permissions covered Exchange mailboxes, OneDrive, SharePoint, Teams and company directories.
As a result, the compromise potentially exposed sensitive communications and business files. However, the ability to reach that information does not establish that attackers actually copied it.
Attackers Added Credentials to Other Applications
Huntress traced the initial activity to October 15, when attackers authenticated from IP address 144.172.64.128. They then sent automated requests across customer environments within seconds.
In one case, the compromised application elevated its privileges to Global Administrator. It subsequently added credentials to two other applications: an MSP management tool and the Huntress security platform.
Those new credentials could remain valid until 2028 unless administrators revoke them or otherwise block their use. Therefore, disabling the original ConnectWise application might not eliminate every access route the attackers created.
The finding highlights a central concern in the ConnectWise breach: attackers could use one trusted integration to establish access through others.
A Second Wave Focused on Sensitive Sectors
Huntress also identified a separate wave of targeted attempts against 16 tenants. These organizations operated in policy, national security, trade and critical minerals.
The attempts involved several Microsoft services, including Exchange Online, SharePoint, Teams, Entra and Azure Resource Manager. However, Huntress reported that this second wave did not succeed.
The targeted activity adds context to the investigation without establishing further successful compromises among those organizations.
ConnectWise Suspended Services and Disabled Identities
On October 17, ConnectWise disabled seven application identities and suspended Cloud Backup, SaaS Security and Cloud Management services.
As of October 19, backups, archives and security monitoring remained unavailable. The company had not confirmed when it would restore those services.
Meanwhile, ConnectWise said it had observed no successful threat activity in monitored environments since 05:00 UTC on October 17. It also reported no evidence that attackers had accessed encrypted backup archives.
That statement concerns the backup archives specifically. It does not resolve every question about activity inside affected Microsoft 365 tenants.
Existing Tenant Changes Remain a Concern
ConnectWise acknowledged that disabling affected connections prevents new authentication through those connections. However, the action does not reverse changes attackers previously made inside customer environments.
For affected organizations, the remaining investigation therefore extends beyond the original application. Security teams need to establish whether attackers changed permissions, modified configurations or added credentials elsewhere.
CoreView security strategist Kasper Lingaard similarly urged businesses to investigate potential persistence within their Microsoft 365 tenants.
For now, Huntress has not confirmed company data exfiltration. The number of individuals whose information may have been exposed also remains unknown.
0 responses to “ConnectWise Breach Hits Over 300 Organizations as Attackers Plant Lasting Access”