Compromised ConnectWise Credential Grants Hackers Access to 173 Microsoft 365 Tenants
Attackers are exploiting a stolen Microsoft 365 credential belonging to ConnectWise Cloud Backup to gain unauthorized access to 173 customer tenants, potentially exposing sensitive data.
Cybersecurity researchers have identified an active campaign where unknown threat actors are leveraging a compromised Microsoft 365 (M365) credential associated with ConnectWise Cloud Backup (formerly SkyKick) to infiltrate customer M365 environments. ConnectWise Cloud Backup is a service designed for managed service providers (MSPs) to secure their clients' Microsoft 365 or Google Workspace data, and it requires extensive permissions to access mailboxes, OneDrive, SharePoint, Teams, and directory data within each tenant it serves.
Huntress, a security firm, reported observing confirmed unauthorized sign-ins across 173 partner/customer tenants utilizing the compromised vendor credential. The incident poses a risk to any organization that has the ConnectWise Cloud Backup application installed, as the compromised credential is valid across all tenants where the app is consented. Security researcher Jonathan Semon noted that the attackers were observed obtaining Microsoft Graph tokens from the IP address 144.172.64[.]128 on October 15th, between 06:13 and 08:34 UTC, moving through tenants in a systematic order, suggesting the use of an automated script.
The attackers are authenticating to the ConnectWise Cloud Backup application using their own tools, mimicking the service's legitimate functions. By doing so, they obtain Microsoft Graph tokens that inherit the application's existing broad permissions. This allows them to access and potentially exfiltrate sensitive customer data, including emails, files, and directory information, similar to what the backup service itself can access.
In at least one affected tenant, researchers discovered a separate ConnectWise application, the ConnectWise Cloud Management app for Microsoft Teams, had elevated itself to Global Administrator privileges. This application then executed a script that modified other trusted applications within the environment, including an MSP management application and Huntress's own platform. By adding new client secrets to these trusted applications, the attackers created a pathway to gain further privileged access beyond the initial compromise.
This escalation of privileges through the Global Administrator role significantly broadens the attack surface. When an attacker gains control of a privileged application, such as an MSP management tool consented into multiple customer tenants, the compromise can extend far beyond the initial victim. Similarly, compromising a security tool's application grants the attacker the same capabilities as that tool, potentially leading to widespread data access and system compromise.
In parallel analysis, Todyl confirmed detecting an unauthorized party authenticating to Microsoft Graph as the ConnectWise Cloud Backup application. Nicholas Koken, Todyl's head of Detection Engineering, stated that the inherited permissions allowed read/write access to mail, attachments, OneDrive, SharePoint files, and Teams chats, with the capability to restore data. He also highlighted that revoking user sessions does not end this access, and tokens issued before the app is disabled remain valid for up to 90 minutes, leaving tenants exposed until ConnectWise rotates the credential.
In response to the incident, ConnectWise has temporarily disabled access to the Cloud Backup application and is investigating the full scope of the compromise. The company has stated it has found no evidence that partner backup data itself has been compromised. They have provided indicators of compromise, including suspicious IP addresses and specific application IDs to monitor in Microsoft Entra Admin Center sign-in logs. Users are advised to disable the application, enable Microsoft Graph activity logs, audit for newly added credentials, and check Entra audit logs for suspicious application role assignments.
This incident underscores the critical security risks associated with third-party vendor credentials and the extensive permissions granted to cloud-based services. The ability for attackers to leverage these permissions for widespread data access and further system compromise emphasizes the need for robust credential management, regular security audits, and prompt incident response from both vendors and their customers.