Attackers exploited a compromised ConnectWise Cloud Backup credential to gain unauthorized access to Microsoft 365 customer environments. Jonathan Semon confirmed sign-ins across 162 tenants as of 19:00 UTC on October 16, raising concerns about privileged vendor applications and persistent access. An IT admin in the Microsoft Entra Admin Center (Source: Huntress) observed a login attempt that appears as if it were performed by an internal script targeting a list of tenants.
Given the extensive permissions required by the backup application, attackers could potentially gain access to mailboxes, OneDrive, SharePoint, Teams, and directory information.
In a single tenant, Huntress discovered that ConnectWise Cloud Management – MS Teams automatically assigned itself Global Administrator privileges without adding client secrets to two other applications: an MSP management tool and the partner's single-tenant Huntress Security Platform application.
IOCs IOC Type Indicator Description Application name ConnectWise Cloud Backup Trusted backup application used to access Microsoft 365 customer tenants Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae Legitimate ConnectWise Cloud Backup OAuth application, formerly SkyKick Backup Publisher SkyKick Publisher name linked to the affected application Source IP address 144.172.64[. ]128 IP address associated with suspicious service principal authentication and related activity User agent Python-urllib/3.12 Python user agent observed during suspicious activity User agent python-requests/2.31 Python Requests user agent linked to authentication activity User agent python-requests/2.34.2 Additional Python Requests user agent reported by Microsoft
