Hackers have exploited a stolen credential from ConnectWise Cloud Backup to infiltrate 173 Microsoft 365 accounts. This breach highlights the significant risks posed by compromised vendor secrets that can impact multiple organizations, especially when wide permissions are involved in multitenant applications.
ConnectWise Cloud Backup Compromise
The compromised product, known as ConnectWise Cloud Backup, was previously called SkyKick Backup. Managed service providers commonly use it for safeguarding Microsoft 365 and Google Workspace data. The application requires access to various Microsoft 365 resources such as Exchange, OneDrive, SharePoint, Teams, and directory data for backup and restoration tasks.
Microsoft’s Threat Intelligence team has confirmed they are monitoring a supply chain attack that involves the ConnectWise Cloud Backup application. The attack involves a threat actor leveraging the trusted OAuth app to acquire access tokens, thus compromising security.
Unauthorized Access Across Multiple Tenants
Huntress, a cybersecurity firm, verified that an API secret from the vendor was compromised, leading to unauthorized access across 173 Microsoft 365 tenants. The access was achieved via a client assertion from the vendor’s home tenant, bypassing individual customer environments.
Using the ConnectWise Cloud Backup application ID, the attackers executed an automated script to access tenant identifiers systematically. The process involved obtaining Microsoft Graph access tokens, which granted permissions pre-approved by users, without requiring passwords or multi-factor authentication.
Implications and Preventive Measures
A significant breach was noticed in a Huntress partner tenant, where an additional app named ConnectWise Cloud Management – MS Teams was assigned a Global Administrator role. This app used a Python script to insert new client secrets into other trusted applications, with expiry dates set in 2028, potentially allowing further unauthorized access.
Security experts recommend reviewing all app secrets and certificates, as disabling the original ConnectWise apps does not remove credentials already embedded in other applications. Sign-in logs showed activity from private IPv6 ranges, which, while not definitive evidence of malicious activity, should be scrutinized.
Future Outlook
The rise in OAuth and service principal abuse suggests a growing trend in cybersecurity threats. Organizations are advised to check the Service principal sign-ins view in the Microsoft Entra admin center. They should filter for unusual application IDs, IP addresses, and Graph API activities.
Organizations should disable the affected ConnectWise service principals without deleting them to retain consent for service recovery. Admins should review directory roles, app credentials, and conditional access exclusions. ConnectWise has implemented containment measures, but the full extent of the breach is still under investigation.
