“The credential belongs to the application itself, so the attacker inherited the permissions granted to it. Multi-factor authentication (MFA) doesn’t apply because this is an application sign‑in, so no user, device, or MFA prompt is involved,” said Justin Kohler, chief product officer at SpecterOps.
ConnectWise suspends Cloud Backup, SaaS Security and Cloud Management
ConnectWise has taken several cloud services offline after discovering unauthorized access tied to its Microsoft 365 integrations. In a security advisory the company said Cloud Backup (previously known as SkyKick), SaaS Security and Cloud Management are unavailable while the firm investigates the incident and works toward restoration. “We understand that this interruption affects your ability to support your customers. We do not yet have a confirmed restoration time and will share a timeline as soon as we can do so reliably,” ConnectWise wrote in an October 19 update.
Timeline: investigation opened October 15; unauthorized access identified October 17
ConnectWise began investigating suspicious activity on October 15. By October 17 the company said it had identified “unauthorized access to application identities within the ConnectWise Cloud Backup environment.” That discovery prompted the decision to suspend affected cloud services while the company continues its forensic work.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadHow application identities can be abused to access Microsoft 365 tenants
The advisory and outside experts describe a technical pathway that bypasses user-facing controls. A Microsoft 365 tenant, the source explains, is “a dedicated instance of Microsoft services used by an organization to store their data separately.” ConnectWise says attackers could authenticate to an application using tenant tooling “in the same way the backup service would,” obtain tokens with the app’s existing permissions, and thereby gain access to the tenant’s directories and data.
As Justin Kohler put it, “Backup tools need broad access to read and restore data. Anyone holding the app’s credential can reach the same mailboxes, OneDrive and SharePoint files, Teams data, and directory information the backup service can.” The advisory emphasized that MFA protections do not apply to application sign‑ins, because those sign‑ins do not trigger user or device MFA prompts.
Huntress observed attackers assigning Global Administrator roles in at least one tenant
Researchers at Huntress, who have been tracking the ConnectWise incident, reported that in at least one observed customer tenant an attacker elevated themselves to a Global Administrator role. Huntress said the attacker then attempted to modify permissions for other applications, including an MSP management application and Huntress’s own security application. ConnectWise has stated it has not yet discovered any indication that partner backup data has been compromised, but the company said it will “continue investigating potential unauthorized access.”
ConnectWise customer guidance and immediate actions
ConnectWise has urged customers to take specific containment and investigative steps. The advisory lists the following actions for customers to carry out:
- Verify the status of the listed application connections and keep affected applications disabled until ConnectWise provides restoration instructions
- Preserve available sign-in and audit records promptly, while taking any urgent containment action
- Review application and user authentication, application credentials and federation trusts, directory roles, owners, consent grants and recent policy changes
- Check for unauthorized mailbox forwarding, inbox or transport rules and delegated mailbox access
- Investigate any other identities changed or used during suspicious activity; disabling the original applications does not remove those separate access paths
What this means for MSPs, security teams, and enterprise customers
MSPs: The outage directly limits the ability of managed service providers to support customer environments while ConnectWise services remain offline, and it raises an immediate need to preserve audit logs and examine other access paths that an attacker could have created.
Security teams: Analysts should prioritize preservation of sign‑in and audit records, review application credentials and consent grants, and look specifically for changes to directory roles and federation trusts — actions the advisory itself lists as urgent.
Enterprise customers: Tenant owners should check for mailbox forwarding, inbox or transport rules, and delegated mailbox access, and be aware that application credentials — not user accounts — are the vector described in the advisory, meaning MFA on user accounts will not block such access.
ConnectWise has not attributed the activity to any specific threat actor, stating: “We cannot discuss threat actor attribution at this time. Our focus is on investigation, remediation, and supporting affected partners and their customers.” The company’s ongoing investigation, the suspended services and the lack of a restoration timeline leave concrete questions about exposure and recovery in the near term. For now, customers and defenders are left to preserve logs, lock down application connections, and monitor for abuse paths the advisory highlights.
