Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack

The incident involves a supply-chain attack targeting ConnectWise's Cloud Backup service (formerly SkyKick Cloud Backup), which integrates with Microsoft 365 tenants using application identities (service principals) granted broad permissions. Attackers accessed these service principals' secrets, allowing automated sign-ins that bypassed user-based protections like MFA. This access enabled reading and writing of emails, files, and Teams chats. Some attackers escalated privileges by assigning themselves directory roles such as Exchange Administrator and Global Administrator, establishing persistence and adding credentials to management tools. The attack originated from a single IP address and involved scripted sign-in attempts. ConnectWise disabled application access and is conducting remediation, while Microsoft and cybersecurity firms recommend tenant administrators review service principal activity and credentials for unauthorized changes.

Attackers gained unauthorized access to Microsoft 365 tenants by abusing existing permissions granted to ConnectWise's Cloud Backup application identities. This allowed them to read and write emails, files, and Teams chats, and in some cases escalate privileges to administrative roles and establish persistence. Although no evidence shows backup archives were compromised, the attackers' ability to manipulate tenant data and escalate privileges poses significant risks to confidentiality and tenant security. The attack bypassed multi-factor authentication due to the use of application identities rather than user accounts.

ConnectWise has shut down the Cloud Backup service to prevent further unauthorized access and is investigating the breach. Tenant administrators should review service principal sign-ins in Microsoft Entra ID, filtering by the ConnectWise Cloud Backup application ID and other related application IDs, to identify unexpected sign-ins and source IP addresses. They should also examine application credential changes, OAuth grants, and Microsoft Graph API activity for suspicious behavior. Huntress recommends disabling implicated ConnectWise applications and reviewing all application secrets and certificates for unauthorized additions since October 13. Since existing tokens remain valid until expiration, revoking user sessions alone is insufficient; administrators must remove compromised credentials. No official patch is indicated; remediation relies on credential review and application access controls.