Compromised ConnectWise Credential Used to Access 173 Microsoft 365 Environments in Supply Chain Attack

A compromised credential belonging to ConnectWise Cloud Backup, previously known as SkyKick Backup, was used to gain access to at least 173 partner and customer environments in Microsoft 365. Microsoft Threat Intelligence has classified the incident as an active supply chain attack.

The unauthorized access did not rely on passwords or second-factor authentication. Instead, the attacker leveraged a client assertion issued from the vendor’s environment and presented itself as an already-approved application identity, successfully obtaining tokens from Microsoft Graph. The activity took place on 15 October between 06:13 and 08:34 UTC. The intruder enumerated environment identifiers in sequence with only seconds between attempts, a pattern consistent with automated scripting against a pre-compiled list of targets.

The permissions granted to the backup application included access to Exchange, OneDrive, SharePoint, Teams, and directory information. In at least one environment, another application from the same vendor was assigned the global administrator role and planted secrets in two trusted applications, with validity extending until 2028. The reported figure of 173 environments is considered a lower bound, as the credential could be used against any tenant where the application had been consented. The count had already risen from 162 on 16 October to 173 the following day.

As of 17 October, ConnectWise disabled seven application identities, revoked certificates associated with the affected connections, and suspended Cloud Backup services, rendering scheduled backups and restores unavailable. While disabling the connections prevents new authentications, previously issued tokens may remain valid until they expire. Organizations are advised to disable rather than delete the applications to preserve consent records and to review enterprise applications for any credentials added since 13 October.