By 
A significant cyber incident has come to light involving the ConnectWise Cloud Backup service, which is used by numerous Microsoft 365 tenants. Reports indicate that hackers gained access to application identities, resulting in unauthorized access to tenant data. This breach raises serious concerns about the integrity of supply-chain security protocols in cloud services.
On October 15, administrators began observing unusual login attempts within their Microsoft 365 tenants attributed to a possible breach connected to SkyKick, a provider involved with ConnectWise. Cybersecurity platform Huntress soon confirmed the alarming situation, reporting at least 162 compromised tenants under its monitoring. Microsoft corroborated these findings in a security advisory, acknowledging that it detected suspicious authentication attempts coming from a specific IP address on the same day.
The ConnectWise Cloud Backup service, previously known as the SkyKick Cloud Backup, offers essential data backup and recovery solutions for managed service providers and IT teams. This service facilitates secure storage and restoration of crucial data, including emails and files, primarily in environments such as Microsoft 365 and Google Workspace.
According to ConnectWise, the breach can be traced back to unauthorized access to application identities within its Cloud Backup environment. As a precautionary measure, the company has temporarily shut down access to the Cloud Backup service while it investigates the situation. They stated, "We have no indicators to date that Cloud Backup partner backup data has been compromised," providing some reassurance to their customers. However, administrators are advised to stay alert as investigations continue apace.
The malicious activity appears to have begun with attempts from a single IP address, 144.172.64.128. Alarmingly, some users reported seeing notifications from Microsoft Privileged Identity Management indicating that the SkyKick service had assumed privileged roles, such as Exchange Administrator, even when the application had not been in use for a considerable time. The connection to specific application identities has been further supported by multiple cybersecurity firms, including Microsoft and Todyl, which identified direct authentications using a pre-existing service principal—a type of application identity granted permissions to access tenant resources.
Researchers revealed that the attackers successfully gained access by abusing pre-existing permissions. Because these sign-in attempts were executed through an automated script, traditional security measures like multi-factor authentication were rendered ineffective. As a result, the threat actors had extensive capabilities that allowed them to read and manipulate sensitive data across different facets of Microsoft 365, including emails, OneDrive documents, and even Teams chats.
Initial investigations indicated a range of ramifications, with Huntress reporting suspicious activities across nearly 50 monitored tenants. In one instance, an attacker was able to maintain access for several minutes and assign themselves roles like Global Administrator, effectively solidifying their foothold within the environment. This demonstrates a worrying level of sophistication, as they managed to configure credentials within third-party tools used by managed service providers.
Additionally, Microsoft noted that persistent efforts from the attackers included using a backdoor method following authentication via the compromised service principal. This backdoor enabled them to engage in reconnaissance activities, searching for further avenues to exploit by adjusting credentials through the Microsoft Graph API.
Experts have reported various user agents associated with the malicious activities, indicating that the attackers were using standard Python libraries for automated requests, which obscured their actions amidst legitimate traffic. Specific guidance has since been issued to affected administrators, directing them to conduct thorough reviews of their tenant activities, particularly around the implicated Cloud Backup application ID and related service principals.
In light of this attack, ConnectWise has urged administrators to scrutinise their service principal sign-ins, filter activities by the relevant application IDs, and verify the legitimacy of any unexpected source addresses. They also recommend auditing credentials and checking for any unauthorized additions that may have surfaced since the attack began.
By October 17, ConnectWise had officially announced the suspension of its Cloud Backup service while they continued their investigations. Although the backup solution's archives remained encrypted and reportedly untouched, all service functions—including scheduled backups—have been halted.
As of the latest updates, the extent of the attack's impact remains unclear, with numerous tenants still vulnerable and the nature of data theft uncertain. While access tokens for previously issued applications might continue to function until they expire, ConnectWise has cautioned that disabling the application does not invalidate such tokens instantly.
This cybersecurity incident underlines the critical need for ongoing vigilance and the robust assessment of third-party applications within cloud environments. With the ConnectWise situation evolving, it serves as a stark reminder to all organisations about the importance of proactive security measures and the thorough examination of application permissions within their Microsoft 365 environments.
Source: bleepingcomputer.com
