ConnectWise Cloud Backup credentials abused to hijack 162 Microsoft 365 tenants

Hackers leveraged stolen ConnectWise Cloud Backup credentials to breach Microsoft 365 tenants

At least 162 Microsoft 365 customers saw unauthorized sign‑ins after the ConnectWise Cloud Backup service was compromised. The activity originated from a single IP address (144.172.64.128) on October 15.

Attack flow

Todyl researchers saw the attacker authenticate directly to Microsoft 365 as the backup application, using its secret. The sign‑ins were performed by an automated script, rendering multi‑factor authentication useless. User‑agent strings such as curl/7.88.1, python‑urllib/3.12 and python‑requests/2.34.2 were observed.

In nine examined tenants, the only activity was the sign‑in itself; there was no evidence of new accounts, permission changes, password resets, or persistence beyond the backup app token.

Huntress discovered that service principals for ConnectWise’s Cloud Management apps assigned themselves directory roles—most often Exchange Administrator—in nearly 50 tenants. In a single tenant the Cloud Management – MS Teams app escalated to Global Administrator and added credentials to an MSP tool and to Huntress’s own application.

Microsoft later observed back‑door‑style persistence after the service‑principal authentication, followed by Microsoft Graph API reconnaissance and further attempts to add credentials.

Why it matters

The abuse exploits the OAuth grant model: once the backup app’s secret is known, the attacker can act with any permissions the customer originally granted, including high‑privilege roles like Exchange Administrator or Global Administrator. Because the tokens remain valid until expiry, simply disabling the app stops new tokens but does not revoke existing ones.

Who is affected

Huntress identified compromised sign‑ins in at least 162 Microsoft 365 tenants. The affected services include:

• ConnectWise Cloud Backup (formerly SkyKick Cloud Backup)
• ConnectWise Cloud Management apps for Exchange Online, Microsoft Teams, Microsoft Graph, Partner Center, SharePoint Online
• Microsoft Entra ID and Microsoft Graph API

Google Workspace was also listed among the products in the vendor’s ecosystem, though no specific compromise was reported.

Immediate defensive actions

Microsoft and the security firms recommend a rapid audit:

• In Entra ID, filter service‑principal sign‑ins by the Cloud Backup application ID 506e08f9-6e9a-4da4-942b-a099a03644ae and flag any unexpected source IPs.
• Review all OAuth grant changes and application credential updates for the period starting October 13.
• Disable the compromised ConnectWise Cloud Backup and Cloud Management applications until their secrets are rotated.
• Rotate or revoke any certificates and secrets associated with those application IDs; consider forcing token expiration.
• Monitor Microsoft Graph API activity for anomalous queries or role assignments.

ConnectWise has shut down customer access to its Cloud Backup service as of 05:01 UTC on October 17. The vendor says stored backups were not accessed and will be available once the service is restored.

Long‑term considerations

Because existing tokens can linger, organizations should enforce token lifetimes and regularly audit privileged application permissions. Implementing conditional access policies that block sign‑ins from unknown locations or requiring certificate‑based authentication for service principals can add another layer of protection.