By Pevita Pearce 
Software and IT management giant ConnectWise is scrambling to restore several of its core cloud offerings, including Cloud Backup, SaaS Security, and Cloud Management, after malicious actors successfully abused a compromised vendor credential to infiltrate customer Microsoft 365 environments. The security incident has forced the company into an aggressive containment posture, triggering widespread service outages for managed service providers (MSPs) and their downstream business clients.
The crisis began unfolding in mid-October when ConnectWise security operations detected abnormal behavior tied to its application infrastructure. Swiftly prioritizing ecosystem defense, the company suspended its Cloud Backup service—historically known in the industry as SkyKick—on October 17. The emergency shutdown came roughly 12 hours after internal investigations into suspicious sign-in activities first commenced.
In an official status communication addressing the incident, the company explained the rationale behind the sudden outage. ConnectWise stated that it recently identified unauthorized access to application identities residing within the ConnectWise Cloud Backup environment. As an immediate protective measure designed to safeguard its Cloud Backup partners and their respective clients, the organization made the difficult decision to completely shut off Cloud Backup application access while remediation efforts got underway.
The defensive measures did not stop with backups. As telemetry poured in and the scope of the intrusion became clearer, ConnectWise leadership decided the following day to proactively shut down its SaaS Security and Cloud Management platforms as well. These secondary service suspensions were executed to implement deeper technical mitigations and prevent any potential lateral movement. Throughout the ordeal, ConnectWise has maintained that customer data and backups remain fully encrypted and protected, emphasizing that its ongoing forensic reviews have yielded no evidence indicating unauthorized access to the underlying backup data repositories themselves.
Despite the necessary precautions, the containment measures have introduced severe operational friction for IT professionals relying on the toolset. The widespread service interruptions continue to impact scheduled automated backups, archive access, and critical file restoration procedures. Furthermore, SaaS Security monitoring and alerting functions have gone dark, alongside the disruption of Cloud Management user and license management capabilities. As of the latest updates, ConnectWise has not provided an estimated restoration timeline, leaving affected MSPs in a state of suspended animation as they wait for the all-clear.
In an effort to assist the broader IT community with remediation and threat hunting, ConnectWise has shared critical technical indicators of compromise, including the specific IP addresses observed during the intrusion. The company also published detailed guidance directed at helping managed service providers thoroughly review their Microsoft 365 environments for signs of lingering persistence or unauthorized configuration changes.
The full picture of how the breach occurred began to crystallize thanks to independent analysis from cybersecurity firm Huntress, which published a comprehensive breakdown of the vendor-level compromise. According to Huntress, the compromised Cloud Backup credential was actively leveraged to breach Microsoft 365 tenants starting on October 15. Telemetry gathered by the cybersecurity researchers revealed that the Cloud Backup application identity was observed authenticating to 162 distinct Microsoft 365 tenants within a narrow window between October 15 and October 16.
The nature of the authentication leaves little room for speculation regarding the vector, according to the security firm. Huntress noted that the authentication itself is absolute and verifiable, stemming directly from Microsoft’s own sign-in logs residing within each individual affected tenant. Crucially, the credential type utilized was a client assertion, indicating firmly that the credential lived securely within the vendor’s own tenant environment rather than being exposed or harvested locally by any action taken by an end customer.
Further compounding the complexity of the threat actor’s campaign, investigative teams discovered that the activity originated from the exact same IP address that had been observed between October 13 and October 14 executing password-spraying attacks against four distinct law firm tenants, alongside various automated and scripted sign-in attempts.
The intrusion exhibited sophisticated automation and multiple operational stages. In at least one monitored customer tenant, Huntress observed the ConnectWise Cloud Management application for Microsoft Teams autonomously adding itself to the privileged Global Administrator role on October 15. Shortly thereafter, the application executed a Python script designed to generate and append new client secrets to an internal MSP management application, as well as to Huntress’s own monitoring application.
This suspicious self-elevation and script execution occurred approximately two and a half hours prior to the initial wave of direct sign-ins originating from the attacker’s external IP address. Interestingly, this phase of internal application manipulation originated directly from Microsoft’s internal cloud network infrastructure rather than the external IP address tied to the later credential abuse. Because of this architectural split, Huntress researchers noted they have not yet definitively tied the initial internal application manipulation phase to the exact same operator wielding the external IP address.
The application’s administrative credentials were clearly operating in hostile hands. Threat actors utilized the compromised access to successfully acquire Microsoft Graph tokens across targeted customer tenants from the IP address 144.172.64[.]128 on October 15 between 06:13 and 08:34 UTC. The malicious actor traversed the ecosystem of targets in a methodical, sorted GUID order, spaced mere seconds apart, which strongly points to an automated script executing commands from a predefined target list.
By October 17, Huntress had identified direct sign-in activity originating from the attacker’s infrastructure across nearly 1,000 Entra tenants, with over 300 of those login attempts resulting in successful authentication. However, security analysts noted that a successful sign-in did not automatically equate to a full system compromise; in targeted tenants that lacked the relevant ConnectWise service principal deployed, the attackers were effectively blocked from gaining deeper access.
Huntress expressed high confidence that the threat actor also abused several other ConnectWise tools during the campaign, specifically targeting the Cloud Management Exchange Online, Microsoft Teams, and SharePoint Online applications. All three of these service integrations have since been forcibly shut down by ConnectWise as part of its broad containment strategy.
While ConnectWise has successfully halted the active attack vector, cybersecurity experts warn that the danger to individual businesses is far from over. Organizations now face the daunting and meticulous responsibility of verifying that the threat actor did not covertly alter any Microsoft 365 configurations or establish long-term persistence mechanisms within their enterprise tenants.
Industry analysts point out that many businesses labor under dangerous misconceptions regarding cloud platform responsibilities. More than a third of IT leaders continue to operate under the mistaken belief that Microsoft automatically performs comprehensive backups of all tenant configurations, a dangerous oversight that makes recovery from a vendor-level supply chain attack significantly more complex and challenging for internal IT and security teams.
Ali Ikhwan 
Nana Muazin 
Asep Darmawan