- Adversaries leveraged compromised Microsoft 365 credentials associated with ConnectWise Cloud Backup (formerly SkyKick) to access 173 customer tenants.
- ConnectWise initiated a widespread service shutdown, suspending Cloud Backup, SaaS Security, and Cloud Management modules to contain the fallout.
- Cybersecurity firm Huntress revealed that abused identities self-assigned Global Administrator rights and generated persistence credentials in third-party enterprise apps.
Supply Chain Compromise Hits Cloud Backup Infrastructure
A major cybersecurity incident has hit managed service providers (MSPs) after threat actors compromised an API credential belonging to the ConnectWise Cloud Backup service, formerly known as SkyKick. Threat analysts confirmed that the compromised secret enabled unauthorized access to at least 173 enterprise Microsoft 365 tenants.
ConnectWise disclosed that it discovered unauthorized access to internal application identities on October 15 and issued customer advisories the following day. To mitigate further exposure, the company temporarily halted Cloud Backup operations along with integrated platforms, including SaaS Security and Cloud Management. Customers were left unable to create backups, view archives, or restore assets during the blackout.
Privilege Escalation and Malicious Persistence
Security researchers at Huntress observed sophisticated abuse of the compromised platform. According to Huntress, an application identity labeled ConnectWise Cloud Management - MS Teams (Application ID: 24205314-2b89-4e07-a2a4-579e898a5640) escalated its own permissions inside a partner tenant to Global Administrator.
The application subsequently injected new credentials into two external enterprise tools, including a single-tenant Huntress app. Sophisticated automation in attacks against distributed targets continues to be a growing vector across the industry, reminiscent of how a hacker deploys an army of AI agents to infiltrate over 100 corporate websites.
| Application Identity (App ID) | Affected Platform Service | Observed Impact |
|---|---|---|
| 506e08f9-6e9a-4da4-942b-a099a03644ae | ConnectWise Cloud Backup | Unauthorized tenant authentication |
| 24205314-2b89-4e07-a2a4-579e898a5640 | ConnectWise Cloud Management - MS Teams | Global Admin assignment & key generation |
Vendor Containment and Remediation Efforts
Jason Ferguson, Vice President of Security Operations at ConnectWise, clarified via a community statement that existing customer archives remain encrypted, isolated, and showed no indications of unauthorized data access. The company deployed multiple defensive measures to isolate the incident:
- Disabling seven application identities associated with ConnectWise services;
- Revoking third-party integrations between Cloud Backup, SharePoint Online, Exchange, and Teams;
- Performing sweeping account resets and issuing new application credentials;
- Strengthening access policies across administrative control planes.
ConnectWise emphasized that it currently cannot discuss threat actor attribution as active digital forensics and threat-hunting workflows remain underway.
Deactivating the compromised ConnectWise application IDs will not automatically purge credentials already created by the attacker. IT administrators managing Microsoft 365 tenants must immediately audit all registered enterprise applications, inspect audit logs for unauthorized Global Administrator assignments, and delete unrecognized secrets and certificates.
The fact that an app identity could self-assign Global Admin rights is wild. Did the API secret already hold broad tenant permissions, or was there a privilege escalation flaw in the partner integration? I’d be curious to hear how other MSPs are auditing app role assignments to catch this kind of persistence early.