Clarissa Hana
ConnectWise has taken the drastic step of shutting down customer access to its Cloud Backup service, formerly known as SkyKick Cloud Backup, following the discovery of a sophisticated supply-chain attack. Hackers successfully infiltrated the service, gaining access to application identities and subsequently compromising numerous Microsoft 365 tenants. This incident marks a significant breach in the trust placed in third-party vendors managing critical IT infrastructure and data.
The first reports of this malicious activity surfaced on Friday, October 13, 2023, when IT administrators began noticing unauthorized access to sensitive client data within their Microsoft 365 environments. These early observations pointed towards a potential breach involving SkyKick, the acquired entity now operating under the ConnectWise Cloud Backup umbrella. The initial concerns were quickly validated.
By the end of the same day, Huntress, a prominent managed cybersecurity and threat detection platform, confirmed the escalating worries. The company reported identifying at least 162 compromised tenants within its own monitoring environment, painting a grim picture of the attack’s early reach. This figure, however, is likely an underestimate of the true scope, as many organizations may not have yet detected the intrusion.
Microsoft itself corroborated the findings in a subsequent update, confirming the involvement of ConnectWise’s Cloud Backup service. The tech giant’s security intelligence indicated that unauthorized authentication attempts originating from a specific IP address, identified as 144.172.64[.]128, were detected on October 15. This IP address has since become a key indicator for investigators across multiple security firms.
ConnectWise’s Cloud Backup solutions are designed to be a critical component of business continuity and disaster recovery strategies for Managed Service Providers (MSPs) and IT teams. These services provide robust backup and recovery capabilities for essential customer data, including emails, documents, and other files stored within cloud environments such as Microsoft 365 and Google Workspace. For Microsoft 365 backups, the service fundamentally relies on permissions granted through Microsoft Entra ID (formerly Azure Active Directory). Within a customer’s tenant, a specific application identity, known as a "service principal," acts as a digital representative of the software, enabling it to access and manage resources based on the permissions it has been explicitly granted.
Unraveling the Microsoft 365 Tenant Breaches
In a security advisory issued by ConnectWise, the company detailed its discovery of "unauthorized access to application identities within the ConnectWise Cloud Backup environment." In response, they immediately moved to shut down application access for their partners and clients, a decisive action aimed at halting further unauthorized activity. ConnectWise stated, "We have no indicators to date that Cloud Backup partner backup data has been compromised. The existing cloud backup archive is not impacted by this service interruption and will be accessible once services are restored." Despite this assurance regarding the integrity of stored backups, the company launched a comprehensive investigation and initiated remediation efforts to secure its platform and client data.
The genesis of this malicious activity, as pieced together from reports by Microsoft, Huntress, and various administrators, appears to trace back to at least October 15, emanating from the singular IP address: 144.172.64[.]128. Anecdotal evidence from affected parties further illuminates the nature of the intrusion. One user on Reddit shared a notification received from Microsoft Privileged Identity Management (PIM) on October 15. The alert indicated that a SkyKick service principal, despite not having been utilized for years, had inexplicably assigned itself the role of Exchange Administrator. This observation highlights how outdated or dormant permissions can be exploited in sophisticated attacks.
Crucially, the observed malicious activity and the reported service principal IDs associated with the offensive SkyKick actions align with information provided by Huntress, Microsoft, and Todyl, another cybersecurity platform catering to MSPs and IT professionals. This corroboration strengthens the attribution of the attack.
Todyl researchers elaborated on the attack vector, explaining that the threat actor authenticated directly to Microsoft 365 using the backup application’s credentials. This direct authentication leveraged the permissions that customers had already granted to the application when they initially integrated it. The authentication requests were executed via an automated script, bypassing traditional user-based security measures. Because the process did not involve a human user logging in, standard protections like multi-factor authentication (MFA) proved ineffective against this automated intrusion.
"Because the application already held broad, previously granted permissions in each tenant, those sign-ins gave the attacker the technical ability to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats," Todyl stated in their analysis. While Todyl’s investigation into nine compromised tenants revealed only sign-in activity, they found no evidence that the threat actor had created new accounts, escalated permissions, altered passwords, or established persistent footholds within the affected tenants through the backup application itself.
Reconnaissance and Sophisticated Persistence Attempts
However, the findings from Huntress painted a more concerning picture regarding the attacker’s objectives and capabilities. Across nearly 50 tenants under their purview, Huntress observed service principals associated with "ConnectWise’s Cloud Management apps (Exchange Online, Microsoft Teams, and Microsoft Graph)" self-assigning themselves directory roles, predominantly the highly privileged Exchange Administrator role.
In one particularly alarming instance, Huntress researchers documented the attacker establishing persistence within a tenant, a process that took approximately five minutes to execute. During this activity, a Cloud Management application—specifically "MS Teams" with the application ID 24205314-2b89-4e07-a2a4-579e898a5640—granted itself Global Administrator privileges. Furthermore, the attacker added credentials to an MSP management tool and even to Huntress’s own security application, demonstrating a clear intent to maintain access and potentially expand their reach.
Microsoft’s threat intelligence further corroborated these findings, reporting observed persistence activity via a backdoor following successful service principal authentication. This was followed by reconnaissance activities using the Microsoft Graph API and attempts to inject additional credentials into the compromised environment. The consistent tracking of the malicious activity to the same IP address, 144.172.64[.]128, by all three cybersecurity firms—Microsoft, Huntress, and Todyl—strongly suggests a coordinated and sophisticated operation. Microsoft Threat Intelligence has officially characterized this incident as an active supply-chain attack, indicating that the attackers likely exploited existing permissions, potentially including broad entitlements like Directory.ReadWrite.All.
Indicators and Critical Tenant Checks
To aid organizations in identifying potential compromise, Huntress identified the legitimate Cloud Backup application ID used in the attacks as 506e08f9-6e9a-4da4-942b-a099a03644ae. Their investigation also linked the attacker’s IP address to scripted sign-in attempts occurring on October 13 and 14, characterized by the user agent string "curl/7.88.1." Further analysis has revealed at least three distinct user agent strings associated with the malicious Cloud Backup service activity: "python-urllib/3.12," "python-requests/2.31," and "python-requests/2.34.2." These indicators are crucial for forensic analysis and threat hunting.
ConnectWise has issued a strong recommendation for administrators to meticulously review service principal sign-ins within Microsoft Entra ID. They advise filtering these sign-ins by the identified Cloud Backup application ID and scrutinizing any unexpected source IP addresses.
Microsoft echoes these recommendations, urging a comprehensive review of application credential changes, OAuth grants, and related Microsoft Graph API activity within their tenants. These actions are vital for detecting any unauthorized modifications or access.
Huntress provides further guidance, advising administrators to proactively disable the implicated ConnectWise applications. Beyond disabling, they emphasize the importance of thoroughly checking all application credentials for unauthorized additions that may have occurred since October 13 and promptly removing any suspicious entries. A critical note from Huntress highlights that older tenants might list these Cloud Management applications under the legacy name "SkyKick Cloud Manager," necessitating a broader search for compromised applications.
The vendor’s decision to shut down the service, while a necessary containment measure, does not automatically remove any credentials that may have already been planted within customer tenants. Huntress cautions that administrators must actively review secrets and certificates across all integrated applications for unauthorized additions made since October 13, and subsequently revoke these compromised credentials.
Todyl offers a crucial insight into the lingering impact of such attacks. They warn that while disabling an application prevents the issuance of new authentication tokens, any existing tokens that have already been issued remain valid until their expiration. Similarly, revoking user sessions does not terminate access granted at the application or service principal level, underscoring the need for more granular credential management and revocation.
ConnectWise announced the interruption of its backup service at 05:01 UTC on October 17. As of the initial reporting, no definitive timeline for the restoration of services was provided. The company reiterated its lack of evidence suggesting that stored backups themselves were compromised and maintained that existing archives would be accessible once services were reinstated.
At the time of publication, the precise number of victimized organizations and the full extent of data exfiltration remained unclear. Furthermore, the specific methodology employed by the attackers to obtain the vendor credentials necessary to launch this supply-chain attack has not been publicly disclosed, leaving a critical gap in understanding the initial exploit. The ongoing investigation aims to shed light on these crucial details, providing a clearer picture of the attack’s sophistication and its long-term implications for the cybersecurity landscape. The incident serves as a stark reminder of the vulnerabilities inherent in the interconnectedness of modern IT ecosystems and the paramount importance of robust vendor risk management and continuous security monitoring.
