"Because it’s a multi-tenant application, anyone holding that credential can request access tokens in any tenant where the application is installed, without any action by the customer," Jonathan Semon said.
How the incident unfolded
ConnectWise temporarily shut down multiple services after a threat actor gained access to a highly sensitive credential used by ConnectWise Cloud Backup (formerly SkyKick). Researchers observed an initial wave of attacks on a Friday; by late Saturday Huntress reported sign-in activity from malicious infrastructure across almost 1,000 Entra tenants, with more than 300 of those sign-ins appearing to succeed, Jonathan Semon, principal security operations analyst at Huntress, told CyberScoop.
Microsoft Threat Intelligence reported it observed broad successful sign-ins from a malicious IP address on Oct. 15, and said follow-on activity included Microsoft Graph API reconnaissance and attempts to add additional credentials on the related service principal in target tenants to maintain direct access as a backdoor.
Scope: sign-ins, confirmed compromises, and affected services
Huntress — which primarily supports small- to mid-sized businesses — confirmed unauthorized sign-ins in 162 tenants and warned that additional compromises beyond its telemetry are likely. Researchers and vendors named a range of Microsoft 365 services that the attacker could access when the API secret was abused: Exchange Online, Microsoft Teams, SharePoint Online, Cloud Backup, MS Graph and Partner Center.
Todyl, another investigator cited by CyberScoop, said the automated sign-ins gave the attacker the technical ability to read and write mail and files across those Microsoft 365 applications. In tenants where researchers observed post-compromise activity, the application account “elevated its own privileges and added new credentials to other applications in the tenant,” Semon said — an action that would allow persistent access even if the original application were disabled.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildTechnical mechanics: the compromised API secret and multi-tenant risk
Investigators characterized the exposed secret and its chain of command as critical. Because ConnectWise Cloud Backup is a multi-tenant application, possession of the API secret allowed the attacker to request access tokens for any tenant where the application was installed, without any action by the customer, Huntress said. That access permitted Microsoft Graph reconnaissance and attempts to plant additional credentials on the service principal.
The sign-ins were performed by an automated tool and, according to Todyl, the level of access available to the application allowed attackers to bypass controls including multi-factor authentication and to create backdoors that would survive disabling the original integration.
ConnectWise response, mitigation timeline, and unanswered operational questions
ConnectWise suspended its Cloud Backup, SaaS Security and Cloud Management services approximately two days after researchers observed the initial wave of unauthorized sign-ins. A company spokesperson wrote that ConnectWise is “continuing its investigation and remediation following unauthorized access to application identities associated with ConnectWise Cloud Backup,” and that the company is “monitoring our entire environment around the clock.”
ConnectWise said in a security advisory that “since mitigations began on October 17 at 05:00 UTC, we have not observed successful threat activity in the environments we monitor,” but it added that this “does not establish whether individual partner or customer Microsoft 365 tenants were affected; each potentially affected tenant still requires review.” The company declined to answer questions about how attackers obtained the credential for ConnectWise Cloud Backup.
What this means for Microsoft 365 customers, MSPs, and ConnectWise partners
- Microsoft 365 customers: Review tenant logs and apply the indicators of compromise shared by ConnectWise and third-party responders; disable any affected applications even if no unusual activity appears in logs, responders advised.
- Managed service providers and small- to mid-sized businesses: Expect to check for unauthorized service-principal activity, Microsoft Graph reconnaissance signs, and additional credentials added to applications — especially when multi-tenant vendor credentials are involved.
- ConnectWise partners and restoration teams: Continue remediation work and tenant-by-tenant reviews; ConnectWise has not provided a timeline for service restoration and investigators remain engaged to determine the root cause and extent of exposure.
Security responders have shared indicators of compromise to help potentially exposed customers hunt for malicious activity, but researchers and ConnectWise have not publicly attributed the incident to any known threat actor and no group has claimed responsibility. The essential question left by the record so far — how the attacker obtained the critical API secret that enabled rapid, multi-tenant access — remains under investigation.
