ConnectWise breach puts more than 300 companies’ secrets at risk

Using stolen ConnectWise Cloud Backup credentials, hackers have compromised over 300 organizations and are now targeting national security and critical infrastructure sectors.

Security firm Huntress detected suspicious sign-in activity across nearly 1,000 Microsoft Entra customer accounts, with over 300 successful intrusions.

The total number of affected organizations and individual users remains unknown.

How the ConnectWise attack worked

The attack involved stolen application credentials belonging to ConnectWise Cloud Backup, formerly SkyKick, a service used by managed service providers (MSPs) to back up customers’ Microsoft 365 environments.

According to Microsoft Threat Intelligence, attackers exploited permissions previously granted to the trusted application, including Directory.ReadWrite.All, to obtain access tokens across customer tenants.

The breached application could access Exchange mailboxes, OneDrive, SharePoint, Teams and company directories, giving attackers potential access to emails, documents and business secrets.

OAuth application exploitation

As head of research Nextron Systems Florian Roth puts it on X: “One compromised OAuth application with elevated permissions could give attackers access to emails, files, and directory data across hundreds of Microsoft 365 tenants.

Even worse, attackers could establish persistent access by adding credentials to other applications, surviving the revocation of the original compromised credentials.

Florian Roth, head of research Nextron Systems, warns on X.

And with MSPs involved, the potential blast radius could extend even further to downstream customers.

Attackers create backdoors in Microsoft 365

In a blog post, Huntress reported that attackers first authenticated from IP address 144.172.64.128 on October 15th, making automated requests across customer tenants in seconds.

In one instance, the compromised ConnectWise application self-elevated to Global Administrator and injected credentials into two other apps: an MSP management tool and Huntress's security platform.

The malicious credentials were configured to remain valid until 2028, potentially providing continued access after the original compromised application was disabled.

Second attack wave targeted critical infrastructure

Huntress also discovered a second, targeted wave against 16 tenants in the policy, national security, trade and critical mineral sectors.

While the attempts were unsuccessful, they involved Exchange Online, SharePoint, Teams, Entra and Azure Resource Manager.

ConnectWise disables compromised apps and services

Connectwise disabled seven application identities on October 17th and suspended CloudBackup, SaaS Security and Cloud Management services.

As of Monday, key services including backups, archives and security monitoring remain offline with no confirmed restoration date.

ConnectWise said it had not observed successful threat activity in monitored environments since October 17 at 05.00 UTC.

In a status update, it said: “We have no evidence that these archives have been accessed,” the company said, referring to the encrypted backup data.

However, the company acknowledged that disabling compromised applications would not undo changes attackers had already made.

“Disabling the affected connections prevents new authentication through those connections; it does not reverse changes previously made inside the tenant,

warns ConnectWise in a status update.

What did attackers change in your configuration?

Kasper Lingaard, vice president of security strategy at Coreview, urged affected businesses to investigate configuration changes made during the attack.

“ConnectWise has stopped the attack. But businesses unfortunately have the responsibility and difficult task to ensure that the threat actor didn’t change any Microsoft 365 configuration or establish any persistence within their tenant.”

Huntress hasn’t confirmed exfiltration of company data, and the number of people whose information may have been exposed remains unknown.

SonicWall experienced a similar supply chain attack last year, with hackers stealing all cloud backup files including encrypted credentials and configuration data from its firewall backup service.