ConnectWise Suspends Cloud Backup Services Following Microsoft 365 Supply-Chain Breach

ConnectWise has indefinitely suspended its Cloud Backup and Cloud Management platforms after attackers compromised vendor credentials to infiltrate customer Microsoft 365 environments. The breach allowed threat actors to bypass multi-factor authentication entirely by masquerading as the trusted backup application itself.[1][5]

The intrusion centers on stolen application identities, specifically the API secrets used by the former SkyKick service to perform unattended data backups. Because the software requires broad access to function, the attackers inherited permissions to read live mailboxes, SharePoint files, and Teams directories across affected tenants.[2][4]

Security researchers at Huntress first detected the anomaly when the backup application began requesting Microsoft Graph tokens from a commercial hosting provider address rather than its usual Azure infrastructure. The firm initially confirmed unauthorized sign-ins across 162 Microsoft 365 tenants, though the scope quickly expanded.[2][5]

"The app's credential is in hostile hands," Huntress researchers noted, explaining that the compromised secret works against every tenant where the application has been granted consent. The automated nature of the access allowed the attackers to move through target environments just seconds apart.[2]

How the Attack Bypassed Standard Defenses

The incident highlights a structural vulnerability in how cloud backup services integrate with enterprise environments. Rather than targeting individual user accounts, the attackers exploited the service principal—the identity that represents the software within Microsoft Entra ID.[1][3]

When an administrator installs a backup tool, they grant it tenant-wide permissions to access data without user interaction, a requirement for scheduled overnight backups. Because the attacker authenticated directly as this trusted application, standard security measures like multi-factor authentication were never triggered.[1][2]

Coalition, a cyber insurance provider, noted that these elevated permissions make backup applications a high-value target for supply-chain attacks. Once the vendor's API secret is compromised, the threat actor effectively holds a master key to every customer environment that trusts the software.[3]

In at least one documented case, the intrusion escalated beyond data access. A secondary ConnectWise Cloud Management application assigned itself Global Administrator privileges within a customer tenant, effectively taking full control of the environment.[2][5]

After securing administrative rights, the rogue application generated new client secrets for other trusted software in the tenant, including a managed service provider tool and a separate security application. These newly created credentials were set to expire in 2028, establishing long-term persistence.[2][5]

Containment and Service Interruption

ConnectWise acknowledged the unauthorized access on October 16, subsequently disabling seven specific application identities to halt the intrusion. The company revoked the certificates used for the affected connections, severing the attackers' access but also taking the backup service offline.[4][5]

"As a protective measure for our partners and their clients, we are shutting off Cloud Backup application access," ConnectWise stated in its security advisory. The vendor confirmed that containment measures are holding, with no new successful threat activity observed since the mitigations were deployed.[4]

The suspension leaves managed service providers and their clients in a difficult position. While ConnectWise maintains that existing backup archives remain secure and encrypted, customers currently have no ability to restore data or execute new backups until the service is safely restored.[4][5]

The company has not provided a definitive timeline for when the Cloud Backup and Cloud Management platforms will return to normal operation. Engineering and incident response teams are reportedly working alongside third-party specialists to validate the security of the infrastructure.[4]

Microsoft has also intervened, confirming the malicious activity and advising administrators to review application credential changes and OAuth grants. The technology giant identified the initial unauthorized authentication attempts originating from a specific IP address on October 15.[1]

The Burden on Managed Service Providers

The fallout falls heavily on managed service providers, who deploy ConnectWise tools to secure and manage IT infrastructure for thousands of downstream small and medium-sized businesses. These providers must now manually audit their clients' environments for signs of compromise.[1][3]

Security firms are urging administrators to immediately disable the affected ConnectWise applications within their Microsoft Entra ID portals. Deleting the applications entirely is discouraged, as it would remove the underlying consent and complicate the eventual restoration of backup services.[2][3]

The auditing process requires checking every application in a tenant for unexpected credential additions made after October 13. Because the attackers established persistence through other trusted applications, simply disabling the ConnectWise software does not guarantee an environment is secure.[2]

Wirespeed and Coalition have proactively notified policyholders and customers who have the vulnerable backup application installed in their Microsoft 365 tenants. The security teams began their investigations based on early community reports, prior to the formal vendor disclosure.[3]

The incident underscores the cascading risks of the managed service provider ecosystem, where a single compromised vendor credential can expose hundreds of independent organizations. The trust model that allows MSPs to operate efficiently is the exact mechanism the attackers weaponized.[1][5]

Targeted Secondary Attacks

Huntress noted a distinct secondary wave of attacks originating from the same hosting provider address, which specifically targeted organizations in the national security, trade, and critical minerals sectors. However, these attempts largely failed because the targeted tenants did not have the ConnectWise applications installed.[2]

The precision of this secondary targeting suggests the threat actors were not merely executing a broad, automated sweep of available tenants, but also possessed a specific list of high-value intelligence targets. The identity and motivation of the attackers remain unknown.[2][5]

For now, the cybersecurity industry is treating the event as a critical lesson in software supply-chain vulnerabilities. The breach demonstrates that securing user identities is insufficient when application programming interfaces hold the keys to the entire corporate kingdom.[1][3]