ConnectWise Breach Compromises Microsoft 365 Tenants via Identity Theft

Managed service provider software giant ConnectWise abruptly halted all customer access to its Cloud Backup platform following a severe supply-chain intrusion that allowed malicious actors to compromise downstream customer Microsoft 365 tenants. The service, formerly operated as SkyKick Cloud Backup prior to its acquisition by ConnectWise earlier this year, relies on high-privilege application identities within Microsoft Entra ID to back up corporate emails, OneDrive files, and SharePoint documents across thousands of businesses worldwide.

According to emergency advisories distributed to impacted managed service providers, unauthorized threat actors successfully breached backend cloud infrastructure hosting the backup management service. The attackers exfiltrated active cryptographic service principal secrets and delegated authentication tokens, granting them administrative access directly into customer cloud directories without triggering conventional multi-factor authentication defenses.

How hackers abused ConnectWise application identities

The intrusion mechanism represents a classic abuse of cloud identity federation and OAuth application consent workflows. To facilitate automated backups across tenant environments, ConnectWise requires client organizations to authorize enterprise applications with sweeping Microsoft Graph API permissions, including Directory.ReadWrite.All and Mail.ReadWrite.All.

When the threat actors compromised ConnectWise's internal key management enclaves, they harvested the private signing certificates tied to these multi-tenant applications. armed with these valid credentials, the attackers issued automated API calls directly against Microsoft 365 tenant endpoints, effectively impersonating legitimate ConnectWise backup processes while exfiltrating sensitive organizational correspondence and provisioning rogue administrative credentials.

Immediate shutdown of Cloud Backup services

In an effort to sever the attackers' persistent access channels, ConnectWise security teams executed an emergency kill-switch, taking the entire Cloud Backup infrastructure offline and invalidating active application registration endpoints within Microsoft's identity ecosystem. The company retained cybersecurity incident response firm Mandiant to conduct forensic triage across its affected server fleet.

ConnectWise explicitly confirmed that the threat activity was strictly isolated to the standalone Cloud Backup environment and did not impact its flagship Remote Monitoring and Management platforms or ScreenConnect products. However, because client tenants granted persistent API consent years ago, simply taking the vendor's frontend servers offline was insufficient to protect already-compromised downstream directories.

Impact on managed service providers and tenants

The breach has triggered urgent incident response protocols across hundreds of managed service providers who manage IT infrastructure for small and mid-sized enterprises. Because many enterprise administrators configure automated backup utilities once and rarely audit persistent delegated application permissions, several organizations remained unaware that malicious actors had accessed their cloud tenants until receiving official vendor notification.

Security telemetry indicates that the threat actors attempted to leverage their unauthorized tenant access to harvest additional cloud tokens, modify mailbox forwarding rules, and establish secondary persistence mechanisms before ConnectWise took defensive countermeasures. Enterprise cyber insurers have advised all affected MSPs to initiate comprehensive audit logs across every client environment connected to the service.

Remediation steps for affected Microsoft 365 admins

Microsoft and ConnectWise released detailed remediation playbooks instructing system administrators to immediately revoke all enterprise application consent grants linked to the SkyKick and ConnectWise Cloud Backup application IDs. Administrators must navigate to the Microsoft Entra admin center, locate the relevant Enterprise Applications, and perform immediate object deletion rather than simple permission downgrades.

Furthermore, security teams must examine Unified Audit Logs in Microsoft Purview covering the prior thirty days, searching specifically for anomalous service principal logins, unexpected credential additions to existing service principals, and bulk mailbox export commands originating from external IP addresses. IT teams should also enforce immediate password resets and session revocations for all global administrative accounts.

Long-term risks in SaaS supply chain architectures

This critical supply-chain breach emphasizes the profound systemic vulnerabilities inherent in modern cloud backup and software-as-a-service integrations. When third-party vendors demand persistent, standing high-privilege access into enterprise directories, a single upstream breach instantly cascades into thousands of sovereign organizational environments.

Cybersecurity authorities, including CISA and international cyber defense agencies, continue to urge enterprises to adopt continuous conditional access policies and just-in-time privilege models for third-party service principals. Organizations must replace static, multi-year OAuth tokens with short-lived workload identity federation, ensuring that an upstream vendor compromise cannot silently unlock their most sensitive production data.

<div class="tb-sources mt-8 pt-6 border-t border-gray-200 text-sm text-gray-600"> <strong>Sources & Attribution:</strong> <ul class="list-disc pl-5 mt-2 space-y-1"> <li><a href="https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/" target="_blank" rel="noopener noreferrer" class="text-blue-600 hover:underline">BleepingComputer Reporting and Documentation</a></li> <li>Technical advisories and benchmark telemetry verified via official vendor channels.</li> </ul> </div>