ConnectWise backup breach: a stolen secret gave attackers access to 162 Microsoft 365 tenants

On October 15, a Microsoft 365 administrator received an alert from their privileged access management tool: the SkyKick application had just granted itself the Exchange administrator role. According to their post on Reddit, reported by BleepingComputer, they hadn't used the application in years. They are not the only one affected.

That day, a large-scale attack hit customers of ConnectWise Cloud Backup, formerly SkyKick Cloud Backup. On October 16 at 7 p.m. UTC, security firm Huntress confirmed unauthorized logins in 162 Microsoft 365 environments (“tenants”). On October 17 at 5:01 a.m. UTC, ConnectWise cut off partner and customer access to the service, without saying when it would return. According to BleepingComputer, Microsoft describes it as an active supply chain attack.

How a backup tool becomes an entry point

To back up emails, OneDrive and SharePoint files, or Teams conversations, Cloud Backup needs an application identity in Entra ID, Microsoft's directory service. Each customer grants it broad read and write permissions. According to Huntress, the attacker obtained a credential for this application: a secret that is held by ConnectWise, not by customers. “Nothing a customer could have done in their environment could have produced this,” Huntress writes.

Researchers at Todyl explain that the attacker signed in directly as the backup application's identity. No user was logging in, so multifactor authentication (MFA) never had a chance to apply.

Four days of attacks

Huntress has reconstructed the timeline. On October 13 and 14, the IP address 144.172.64[.]128 tried to guess passwords at four law firms, without success. Starting October 15 at 1:58 a.m. UTC, ConnectWise's Cloud Management applications assigned themselves directory roles in about fifty environments monitored by Huntress. The company has not yet been able to verify with ConnectWise whether these changes were legitimate. In one environment, ConnectWise's Cloud Management for Teams application granted itself the Global Administrator role within minutes. It then added new secrets to two other applications, including Huntress's own. These secrets are valid until 2028.

In its October 17 update, Huntress says with “high confidence” that three other ConnectWise applications were hijacked: Cloud Management for Exchange Online, MS Teams and SharePoint Online. At that point, ConnectWise had not disabled them.

Was any data stolen? No one can say at this stage. ConnectWise says it has “no indication” that its partners' backups were compromised. In the environment it analyzed in detail, Huntress sees no access to emails or files. It points out, however, that some directory reads through Microsoft Graph leave no trace in the logs. It is also unknown how the secret was stolen.

What to do if you use ConnectWise or SkyKick

As with the BeyondTrust vulnerability, the danger here comes from a trusted tool with broad permissions. Huntress recommends the following measures, among others:

• Disable, but do not delete, the Cloud Backup (ID 506e08f9-6e9a-4da4-942b-a099a03644ae) and Cloud Management applications. In older environments, they may be named “SkyKick Cloud Manager”. Keep them disabled until ConnectWise has confirmed that all of its credentials have been rotated.
• Check the Service principal sign-ins tab of the Entra sign-in logs: the default view, which shows users, does not display these sign-ins. Search for the address 144.172.64[.]128.
• Review the secrets and certificates of all your applications added since October 13, starting with those of administration and security tools.
• Remove unexpected directory roles and check the exclusions in your conditional access policies.

Todyl stresses one important point: disabling the application prevents new tokens from being issued, but tokens already issued remain valid until they expire. Disabling the application also suspends backups. According to Huntress, backups already stored by ConnectWise are not deleted.

It remains to be determined how the secret left ConnectWise's systems, and how many environments were visited beyond those Huntress monitors.