AnswersPublished23 sources
ConnectWise Cloud Backup Attack: What Microsoft 365 Admins Need to Know
Huntress reported unauthorized sign ins in 173 Microsoft 365 tenants using a compromised ConnectWise Cloud Backup app credential. Because the attacker signed in as a trusted application, user MFA did not apply to that authentication flow.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- Huntress reported unauthorized sign ins in 173 Microsoft 365 tenants using a compromised ConnectWise Cloud Backup app credential.
- Because the attacker signed in as a trusted application, user MFA did not apply to that authentication flow.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What is known about the Microsoft 365 supply-chain attack that prompted ConnectWise to suspend customer access to Cloud Backup, formerly Sky. Article summary: The reported attack used a compromised ConnectWise Cloud Backup application credential to enter customers’ Microsoft 365 tenants through an already-trusted integration, rather than by compromising individual user account. Topic tags: general, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fa
A compromised credential for ConnectWise Cloud Backup, formerly SkyKick, was used to obtain Microsoft Graph access tokens across customer Microsoft 365 tenants. Huntress reported unauthorized sign-ins in 173 partner and customer tenants, but that figure does not mean data theft was confirmed in all 173. The total impact and how the original credential was compromised remain unknown. 1
6
9
What happened
Microsoft described the incident as a supply-chain attack involving a compromised, trusted OAuth application. Customers had already granted the multitenant Cloud Backup application permissions to operate in their environments; investigators say the attacker used those existing permissions to obtain tokens across tenants. The permissions included broad directory access such as Directory.ReadWrite.All. 9
15
Huntress’s reported count rose from 162 tenants at 19:00 UTC on October 16 to 173 in a subsequent update. These are confirmed unauthorized sign-ins, not a final count of affected organizations or proof that information was taken from every tenant. 1
6
9
Timeline and the reported IP address
Huntress observed the application obtaining Microsoft Graph tokens from 144.172.64[.]128 between 06:13 and 08:34 UTC on October 15. The rapid movement between tenants suggested scripted activity. Huntress also reported unsuccessful password-spraying attempts against four law-firm tenants from the same IP address on October 13 and 14. Those earlier attempts do not establish how the Cloud Backup credential was compromised. 1
5
20
Why user MFA did not stop the sign-ins
The activity was authenticated as an application identity, also called a service principal, rather than as an individual user. User MFA therefore was not part of that application sign-in flow. This is different from an attacker bypassing MFA on a user account. 7
11
The application’s existing permissions could potentially provide access to Microsoft 365 resources such as mail, OneDrive, SharePoint, Teams, and directory data. But permission scope is not evidence that all those resources were read. In its examination of nine tenants, Todyl reported the unauthorized sign-ins; that limited finding does not establish what happened in other tenants. 6
19
29
Investigators also found signs of persistence
Huntress reported self-assigned directory roles in nearly 50 tenants. In one observed case, a Teams-management application granted itself the Global Administrator role and added credentials to other applications, including an MSP’s management-tool application and Huntress’s application. These added credentials could provide access paths separate from the original Cloud Backup integration. 1
9
That is why disabling the vendor integration alone may not address every change made during an intrusion. Administrators should also look for unfamiliar application secrets and unexpected role assignments. 1
13
What is known about backups—and what is not
ConnectWise said it had no indicators that partner backup data had been accessed and said existing archives would be available after service restoration. That statement concerns the backup archives; it does not establish that customer data in Microsoft 365 was untouched. No restoration date was announced in the reported update. 4
19
In an October 17 update, ConnectWise said it had revoked certificates used for affected application connections and invalidated shared Cloud Backup credentials. The service interruption and credential actions are containment measures, not a final accounting of the incident’s impact. 3
The available reporting does not establish the total number of affected organizations, the extent of any data theft, or the source of the original credential compromise. Findings from different security firms also cover different sets of tenants, so one firm’s observations should not be treated as a complete picture of all affected environments. 1
9
19
What Microsoft 365 administrators should do
- Disable affected applications while preserving evidence. Huntress advised affected organizations to disable the application. Avoid deleting it before reviewing relevant sign-in, role, and credential changes; follow current vendor and incident-response guidance before reconnecting it.
9
13
- Review applications beyond Cloud Backup. Check for unexpected secrets or credentials added since October 13, as well as unfamiliar role assignments. A vendor credential rotation or service suspension will not automatically remove credentials added to other applications.
1
- Investigate application sign-ins separately from user sign-ins. Since this activity used an application identity, a clean review of user MFA events alone is not sufficient to assess it.
7
- Do not treat missing audit events as proof that no access occurred. Some Microsoft Graph directory-read operations may not leave a directory audit trail, which limits what an absence of events can show.
The central lesson is that a trusted integration can carry significant access across customer tenants. In this incident, confirmed application sign-ins and reported persistence activity warrant investigation even where data theft has not been established. 9
15
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "ConnectWise Cloud Backup Attack: What Microsoft 365 Admins Need to Know"?
Huntress reported unauthorized sign ins in 173 Microsoft 365 tenants using a compromised ConnectWise Cloud Backup app credential.
What are the key points to validate first?
Huntress reported unauthorized sign ins in 173 Microsoft 365 tenants using a compromised ConnectWise Cloud Backup app credential. Because the attacker signed in as a trusted application, user MFA did not apply to that authentication flow.