ConnectWise has disabled seven application identities and suspended its Cloud Backup service after attackers used trusted vendor credentials to enter Microsoft 365 customer environments. The incident is still active, and the company says administrators must examine both their own tenants and every customer tenant they manage.
ConnectWise’s latest advisory says scheduled backups are not running, restoration from affected archives is unavailable and there is no restoration time yet. Existing backup archives remain encrypted and isolated, and the company says it has no evidence those archives were accessed. That reassurance does not cover data inside live Microsoft 365 tenants.
A trusted app became the intruder
Cloud backup software needs broad permission to read mailboxes, files, Teams conversations and directory data so it can copy and later restore them. In Microsoft Entra ID, the software acts through a service principal—an application identity rather than a human account. Whoever controls the application credential can request the same access tokens without a password prompt, user session or ordinary multifactor-authentication check.
Huntress says it found nearly 1,000 tenants with sign-in activity from the attacker-linked address and more than 300 successful sign-ins. It also observed a narrower wave aimed at organizations in policy, national-security, trade and critical-mineral sectors. In one tenant, a second ConnectWise application granted itself Global Administrator and added credentials to two other trusted applications, creating access paths that can survive a reset of the original vendor credential.
Todyl’s investigation explains the mechanism: an attacker presented the backup application’s credential, obtained app-only Microsoft Graph tokens and moved through tenants by script. The permissions could allow read-and-write access to mail and attachments, OneDrive and SharePoint files, and Teams chats. Todyl did not find account creation, permission changes or persistence through the backup app in the nine tenants it analyzed, but it says limited logging makes data-copying difficult to rule out.
Turning off one connection is not cleanup
ConnectWise disabled the seven named application identities at 07:00 UTC on October 17 and later took SaaS Security and Cloud Management offline as a precaution. It says no successful threat activity has appeared in environments it monitors since its mitigations. Previously issued tokens may remain usable until they expire, however, and credentials or permissions planted under different identities require separate removal.
The company tells partners to preserve sign-in and audit records, inspect role and consent changes, review application credentials and federation trusts, and check for unauthorized mailbox forwarding or delegated access. Administrators should keep the affected applications disabled rather than deleting them first, because deletion destroys useful configuration evidence. Older installations may still display SkyKick names.
BleepingComputer reports that Microsoft has described the activity as an active supply-chain attack. The exact number of affected tenants, the amount of data accessed and the original credential-exposure method remain unresolved.
TINA’s view: backup trust needs a smaller blast radius
TINA’s view: this incident exposes a structural bargain in cloud backup: one vendor identity receives sweeping, repeatable access because recovery is impossible without it. That convenience turns a stolen application credential into a master route across customers. ConnectWise’s shutdown is the correct emergency step, but a safe recovery must include tenant-by-tenant credential review, not merely reissuing the vendor key and reconnecting everyone.
This judgment would soften if forensic evidence shows the activity was limited to authentication, every secondary credential is accounted for and Microsoft can demonstrate stronger workload-identity controls that customers can apply by default. It would harden if investigators confirm data theft or more persistence across managed tenants.
The signal to watch is ConnectWise’s reconnection guidance: it should name which credentials were rotated, which logs administrators must preserve and how customers can verify that no hidden application access remains before backups resume.
This article was produced by TINA, TechInform's AI editorial system, using linked public sources. The hero is an original AI-generated editorial illustration.
