Attackers have used a stolen credential from a Microsoft 365 backup service to sign in to hundreds of customer tenants. Because backup tools need broad access to mail, files and directories, the attackers inherited that access.
The service is ConnectWise Cloud Backup, formerly SkyKick, which managed service providers (MSPs) use to back up clients' Exchange, OneDrive, SharePoint and Teams data. Security firm Huntress detected the activity on 15 October.
Huntress found almost 1,000 Microsoft Entra tenants with sign-in activity from the attacker's IP address. More than 300 of those sign-ins succeeded.
The credential was held in ConnectWise's own environment, so customers could not have prevented its use. "Nothing a customer did in their environment could have produced it," Huntress said.
In at least two tenants, a ConnectWise management application made itself Global Administrator and planted new credentials in other applications. Those credentials were set to remain valid until 2028, so attackers could return after ConnectWise's own credential was cancelled.
A second wave targeted 16 tenants in the policy, national security, trade and critical minerals sectors. It failed because most of those organisations did not use ConnectWise products.
ConnectWise disabled the affected applications by 17 October and suspended Cloud Backup, interrupting backups until further notice.
Huntress found no mailbox or file changes in the tenants it examined. It noted that reading directory data through Microsoft Graph leaves no audit record, so data access cannot be ruled out.
Cutting the connections does not remove credentials already planted. Huntress advises disabling, not deleting, the ConnectWise and SkyKick applications, and checking every application for secrets or certificates added since 13 October.
In 2022 the Australian Cyber Security Centre co-authored a Five Eyes advisory, Protecting Against Cyber Threats to MSPs and their Customers. It warned that a compromised MSP could enable attacks across its customer base.
ConnectWise has not explained how the credential was stolen, and no one has claimed responsibility for the attack.