ConnectWise halts backup services amid Microsoft 365 credential abuse
ConnectWise temporarily disabled Cloud Backup along with its SaaS Security and Cloud Management services after attackers exploited a compromised credential tied to the Cloud Backup application, formerly SkyKick. The credential allowed access to Microsoft 365 accounts that had granted the backup app permissions, and Huntress confirmed unauthorized entry into at least 162 tenants. Microsoft has characterized the event as a supply chain attack, and an investigation is continuing.
ConnectWise's Cloud Backup, acquired with SkyKick in 2024, stores copies of email, OneDrive and SharePoint files and Teams chats so MSP clients can recover from deletion or ransomware. Clients grant it broad Entra ID permissions, making it a service principal that reads and writes data without human login. One credential unlocks every organization that approved the app, so a single vendor compromise reached many MSPs' customers — the basis for Microsoft's supply chain label.
Huntress traced sign-ins to 144.172.64[.]128, a hosting provider address, on October 15 between 06:13 and 08:34 UTC, reaching at least 162 tenants in rapid, ordered succession that suggests an automated script. The same address had earlier been used in failed password guessing against four law firms.
The fallout could extend well beyond the 162 confirmed tenants. Because MSPs often manage many small and mid-sized clients, a single compromised application identity may expose email, files and chat data across numerous organizations at once. Businesses that trusted a vendor's backup tool could face follow-on intrusions if credentials planted during the incident remain valid. The episode may also push providers and their customers to scrutinize how broadly third-party applications are authorized inside Microsoft 365.