Attackers used a credential belonging to ConnectWise's Cloud Backup service, formerly known as SkyKick, to sign in to Microsoft 365 tenants run by managed service providers and their customers. The credential let them call Microsoft Graph as the application itself rather than as any user. ConnectWise says it discovered the issue on October 14. By October 18 it had suspended three cloud products: Cloud Backup, plus SaaS Security and Cloud Management as a precaution because they integrate with Cloud Backup.

In an October 16 post, Huntress said it had confirmed unauthorized access in 162 tenants as of 19:00 UTC that day. Cyber Security News reported on October 17 that the confirmed count had reached 173 partner and customer tenants. In an October 17 update, Huntress said that almost 1,000 Entra tenants recorded sign-ins from the attacker's IP address and that more than 300 of those sign-ins succeeded. Microsoft Threat Intelligence, quoted by Cyber Security News, said it was "tracking an active supply chain attack in which a threat actor compromised the trusted OAuth App." No vendor or researcher has named the threat actor, and ConnectWise says it "cannot discuss threat actor attribution at this time."

Why MFA didn't stop it

Most organizations protect their Microsoft 365 tenants with user-level controls such as strong passwords, multi-factor authentication and conditional access policies tied to user sign-ins. Those controls were never involved here. Cloud Backup works as a multi-tenant OAuth application. When an MSP or customer connects it, they grant consent in their own tenant. The application then authenticates with a credential that Huntress describes as a client assertion living in the vendor's tenant, not the customer's.

Cyber Security News notes that the activity was app-only. No user password was entered and no MFA prompt was triggered. Anyone holding the vendor's application credential could request Graph tokens for every tenant that had consented to the app, within the scope of the permissions those tenants had granted. The weak point sat outside the victims' own tenants, so none of their security settings came into play.

How the intrusion unfolded

The sequence below is drawn from Huntress's write-up and ConnectWise's Trust Center advisory. All times are UTC.

  • October 13–14: Huntress saw a password-spray campaign against four law-firm tenants from 144.172.64[.]128, the same address later tied to the app-credential activity.
  • October 14: ConnectWise says this is the date it discovered the issue.
  • October 15, from 01:58: In about 50 tenants, ConnectWise Cloud Management service principals assigned themselves directory roles. Huntress says the user agent points to ConnectWise's own automation, not the attacker.
  • October 15, 03:44–03:49: In one customer tenant, the Cloud Management MS Teams app added itself to the Global Administrator role. In the same window, a Python script added client secrets to other application registrations in the tenant.
  • October 15, 06:13–08:34: Huntress recorded Microsoft Graph tokens issued to the app from 144.172.64[.]128.
  • October 16, 17:47: ConnectWise first published its advisory.
  • October 17, 05:01: ConnectWise shut off Cloud Backup application access.
  • October 17, 07:00: ConnectWise disabled seven application identities: Cloud Backup (application ID 506e08f9-6e9a-4da4-942b-a099a03644ae) and six Cloud Management apps.
  • October 17, 17:00: ConnectWise said it had engaged a third-party incident response firm.
  • October 18, 01:00: ConnectWise says SaaS Security and Cloud Management have also been taken offline, alongside the already-suspended Cloud Backup, and adds a third-party forensics firm.
  • October 19, 01:15: Most recent advisory update at the time of writing.

According to Cyber Security News, the actor moved through tenant identifiers in order, only seconds apart, which suggests that a script was working through a prepared list. Huntress also described a narrower, unsuccessful second wave on October 15 against 16 tenants belonging to organizations in policy, national security, trade and critical minerals. That targeting pattern is notable, but none of the sources links it to a specific actor.

What ConnectWise says, and what it doesn't know yet

ConnectWise says customer backup archives "remain encrypted and isolated" and that it has "no indication that those archives have been compromised." The company also acknowledges several open questions. It says it cannot determine through its own investigation alone which customer tenants were affected. It says whether a product vulnerability contributed "has not been established." It says it cannot discuss attribution. The advisory also warns that previously issued access tokens may remain usable until they expire, so disabling the applications does not end access immediately.

Revoking ConnectWise's applications does not undo changes the attacker made inside a tenant, and ConnectWise's advisory says as much. Cyber Security News points out that credentials planted in other app registrations stay in place after the ConnectWise apps are disabled. Those secrets belong to applications the tenant owns, so they could keep working as independent access paths. In tenants where an application gained Global Administrator rights, the attacker's possible reach goes well beyond backup data.

Indicators published by ConnectWise

ConnectWise's advisory lists the following indicators (IP addresses defanged):

  • IP addresses: 144.172.64[.]128, 144.172.64[.]99, 144.172.64[.]60
  • User agents: Python-urllib/3.12, python-requests/2.31
  • Disabled Cloud Backup application ID: 506e08f9-6e9a-4da4-942b-a099a03644ae

What It Means for Defenders

ConnectWise says it cannot see which tenants were affected, so each MSP and customer tenant that ever consented to Cloud Backup, SaaS Security or Cloud Management has to check its own logs. The guidance below comes from the Huntress and ConnectWise advisories.

  • Disable the ConnectWise enterprise applications, but don't delete them. Huntress recommends disabling them in Entra ID and warns that deleting the application removes consent. Cyber Security News notes that disabling pauses backups without removing backups ConnectWise already stores. Huntress also advises against re-enabling the apps until ConnectWise confirms all credentials have been reset.
  • Audit service-principal sign-ins. Huntress suggests reviewing service-principal sign-in logs from about October 15 01:00 UTC to October 16 02:00 UTC as a minimum. Look for the IP addresses and Python user agents listed above. The second wave and the possibility of longer-lived tokens are good reasons to check beyond that window as well.
  • Look for secrets added since October 13. Huntress advises reviewing every client secret and certificate added since October 13, including on applications unrelated to ConnectWise. Remove any you can't account for, and rotate credentials on any application that was changed.
  • Review directory role assignments and Conditional Access. Check whether any ConnectWise or SkyKick app holds a directory role, especially Global Administrator, and check Conditional Access exclusions. If an app gained a privileged role, treat it as a serious compromise and begin incident response.
  • Plan for token lifetimes. ConnectWise warns that previously issued tokens may still be valid. Keep monitoring Graph activity from the listed indicators after the apps are disabled.
  • Check Entra sign-in logs, not only success rates. Huntress's figure of almost 1,000 tenants with sign-ins from the attacker IP includes failed attempts. A failed sign-in still shows that the tenant was targeted.
  • Inventory third-party app consent. More broadly, this incident shows that a multi-tenant app's credentials live in the vendor's environment, outside your MFA and conditional access controls. Go through the OAuth apps with consent in your tenants and remove permissions you don't need. Where you can, limit high-privilege application permissions.

MSPs that managed many customer tenants through these products should keep a record of which tenants they checked and what they found. ConnectWise has said it cannot produce that list from its side.

Sources