Managed service providers concentrate a lot of trust in a small number of vendor relationships. A backup service, a monitoring tool, a remote access platform: each one holds credentials that work across every customer environment the MSP manages. That concentration is also a force multiplier for attackers. Compromise the vendor's application identity, and you do not need to attack each customer separately.
This is what happened this week with ConnectWise Cloud Backup.
What happened
Attackers obtained credentials for ConnectWise's Cloud Backup application identities, formerly marketed as SkyKick Cloud Backup. The application uses OAuth grants to access customer Microsoft 365 and Google Workspace environments on behalf of MSP customers.
Starting around October 13 and continuing through October 15, scripted sign-in attempts from a single IP address (144.172.64[.]128) authenticated directly as the backup application. Because no human user was logging in, multi-factor authentication did not apply. The application already held the permissions its customers had granted: broad access to mail, SharePoint, OneDrive, Teams, and in many cases directory permissions.
Huntress confirmed at least 162 compromised tenants in its own customer base. Microsoft observed the activity and assessed it as an active supply-chain attack. ConnectWise shut down access to the Cloud Backup service and disabled seven application identities on October 18.
What attackers could access
The scope of access depended on what permissions each customer had granted the application. ConnectWise Cloud Backup applications typically request permissions to perform backups, which means read access to mail, files, and communication data. In some tenants the picture was worse.
Huntress and Microsoft observed cases where attackers went beyond sign-in:
- Service principals assigned themselves Exchange Administrator directory roles.
- In at least one tenant, a Cloud Management application granted itself Global Administrator access.
- The same tenant saw credentials added to an MSP management tool and to Huntress's own application.
- Microsoft observed backdoor activity and Microsoft Graph API reconnaissance.
The potential data exposure, for tenants where attackers had this level of access, includes email, files, calendar data, Teams messages, and potentially the management infrastructure itself.
ConnectWise said it has no indication that backup archive data was compromised, and that existing archives are encrypted and isolated. But the access granted to the application extended well beyond reading backup archives.
Why MFA did not help
This bears repeating because it matters for how organizations think about cloud security.
The attack did not involve user credential theft or phishing. Attackers did not need to bypass any user's MFA. They authenticated as an application, using application credentials. Microsoft 365's security model treats application authentication differently from user authentication: conditional access policies and MFA requirements apply to users, not to application service principals authenticating with client credentials.
The OAuth permission model assumes that application credentials are secret and controlled. When a vendor's application credentials are compromised, every tenant that trusted that application is exposed regardless of how well those tenants manage their own user authentication.
What to do
Immediate actions:
- Search Entra sign-in logs for application sign-ins from app ID 506e08f9-6e9a-4da4-942b-a099a03644ae. Look for sign-ins from unexpected IP addresses, particularly 144.172.64[.]128, and for sign-in activity after October 13.
- Disable all ConnectWise Cloud Backup and SkyKick application identities in your tenant. Check under both names, since older tenants may still list these under the SkyKick branding.
- Do not assume that revoking user sessions is enough. Application tokens have their own expiry schedules and are not invalidated by user session revocation.
- Audit directory role assignments made since October 13. Look for any role assignments to service principals that were not explicitly made by your administrators.
- Check Graph API audit logs for unexpected reconnaissance activity: queries for directory objects, user lists, or management infrastructure.
- If you are an MSP, do this for every tenant you manage. The attack was scripted and systematic.
After the immediate triage:
- Rotate any secrets or certificates associated with ConnectWise integrations in your environment.
- Consider restricting management interface access for backup tools to known IP ranges where feasible.
- Review the permissions granted to other backup and monitoring vendor applications in your environment. An application with backup-only access should not have Directory.ReadWrite.All.
The broader lesson
This attack is a template, not a unique incident. Managed service tooling is high-value target infrastructure precisely because it aggregates access across many customer environments. Attackers who compromise a vendor's application credentials at the right point in the supply chain can access dozens or hundreds of organizations simultaneously.
The defenses are not exotic: monitor application sign-in activity the same way you monitor user sign-in activity, apply least-privilege to OAuth grants, rotate application credentials on a defined schedule, and include third-party backup and monitoring applications in your incident response playbooks. The ConnectWise breach is a reminder that those controls are not optional for MSPs and the organizations that work with them.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your MSP or enterprise needs to work through OAuth permission hygiene or supply-chain threat modeling.