A Microsoft 365 backup service became an entry point into corporate tenants without attackers cracking a single user's password. The application's own credentials opened a path to data without going through multifactor authentication (MFA).
Key points
- What happened: Compromised ConnectWise Cloud Backup credentials led to unauthorized access to Microsoft 365 environments across 162 tenants
- Why it matters: Without going through user passwords or MFA, attackers used the application's own authentication to gain the ability to access email and files throughout a tenant
- What remains: ConnectWise revoked the shared certificate, but credentials planted individually within tenants will remain unless administrators find and remove them
The backup application's keys were stolen
ConnectWise Cloud Backup, formerly SkyKick Cloud Backup, is offered through managed service providers (MSPs) as a backup service protecting corporate Microsoft 365 environments. To back up and restore data such as email, OneDrive, SharePoint, and Teams, it accesses tenant data using broad permissions granted in advance by customers.
On October 15 local time, it emerged that attackers had obtained this application's credentials. According to an investigation published by security company Huntress, unauthorized authentication using the ConnectWise Cloud Backup application ID was recorded across multiple tenants from the hosting provider IP address 144.172.64.128.
Joho no Todai confirmed that unauthorized authentication had been verified in 162 tenants as of October 16 at 19:00 UTC. This figure reflects Huntress's monitored environments, rather than the total number of affected tenants worldwide.
The attackers cycled through tenants at intervals of a few seconds in ascending order of their identifiers (GUIDs). The pattern indicates that an automated script was accessing tenants sequentially from a list of those using the backup service.
Neither passwords nor MFA came into play
The core of this attack is that it never involved an individual's sign-in.
Applications registered in Microsoft Entra ID, formerly Azure Active Directory, have a distinct identity called a "service principal." Acting as this service principal, the backup application presents a client assertion, a credential used to prove the application's identity, to obtain a Microsoft Graph access token. The credentials reside in ConnectWise's tenant; the compromise was not the result of anything a user at a customer company did.
MFA required when users sign in protects human authentication and does not apply to the application's own authentication. With the application's credentials, attackers can access data within its granted permissions regardless of MFA or passwords.
Those permissions are extensive. To perform both backups and restores, the application has tenant-wide read and write permissions for email, attachments, OneDrive and SharePoint files, Teams chats, and directory information. Once attackers obtain a token, every mailbox and site within that tenant becomes technically accessible.
Legitimate backup operations and attacker access use the same application ID. Standard audit logs alone make it difficult to distinguish who performed a read. An investigation by security company Todyl reported that legitimate operations could not be distinguished from unauthorized access in tenants without Microsoft Graph Activity Logs enabled, which record the source IP address of each request.
Administrative privileges seized in five minutes, with keys planted that expire in 2028
Huntress's investigation also documented more serious activity separate from data access using the backup application's credentials.
Between 03:44 and 03:49 UTC on October 15, ConnectWise Cloud Management, a management application for Microsoft Teams, granted itself Global Administrator privileges in one customer tenant. A Python script then ran and added new client secrets to two other applications in the same tenant: an MSP management application and Huntress's own security application. The added secrets were set to expire in 2028.
The sequence was completed in about five minutes.
Across its monitored environments, Huntress also confirmed that ConnectWise Cloud Management applications for Exchange Online, Microsoft Teams, and Microsoft Graph had assigned themselves directory roles, primarily Exchange Administrator, in about 50 tenants.
The attackers followed a multistage process: establish a foothold using the backup application's credentials, escalate privileges through management applications, and plant long-lived credentials in other applications. Password-spraying attacks against four law firm tenants were also recorded from the same IP address on October 13–14.
Certificates revoked, but keys planted in tenants remain
ConnectWise published its first advisory on October 16 local time and revoked certificates for the affected application connections. In an October 17 local-time update, it said it had not observed successful attacker activity in its monitored environments since implementing the mitigations.
Microsoft also confirmed unauthorized authentication from the same IP address and is tracking the incident as a supply chain attack abusing existing application permissions.
However, ConnectWise's revocation of the shared credentials only blocks new connections through that route. Other credentials added within tenants during the five-minute sequence described above are not automatically removed by ConnectWise's revocation. Each tenant's administrators must identify and remove them.
Huntress recommends disabling the affected application, whose application ID is 506e08f9-6e9a-4da4-942b-a099a03644ae, rather than deleting it. Deletion removes consent and would require reconfiguration when service is restored. Huntress says it should not be reenabled until ConnectWise confirms that all credentials have been reset.
ConnectWise Cloud Backup's backup and restore functions are currently suspended. According to ConnectWise, existing backup archives remain preserved in encrypted form, and no evidence has been found that they were accessed.
Todyl's investigation confirmed successful attacker authentication and permissions to access data in tenants it monitors, but found no evidence that large volumes of data were actually exfiltrated. Todyl stresses, however, that this absence reflects the investigation's limitations and does not establish that the environments were safe. Because directory reads through Microsoft Graph leave no audit trail, the means of determining retrospectively whether reads occurred after access tokens were issued are limited.
A backup service has access to the same data it is meant to protect. When that trust collapses because of a single compromise of the provider's credentials, the entry point lies outside a company's own administrative control, MFA offers no protection, and logs do not distinguish attackers from the legitimate service. Application permissions entrusted to external services create an attack surface separate from user accounts.
Originally published on Joho no Todai. The Japanese original is here.
Top comments (0)