The Anatomy of the ConnectWise Cloud Backup Breach
A critical security incident has emerged involving the compromise of ConnectWise Cloud Backup, a widely utilized tool among managed service providers (MSPs). Threat actors have successfully obtained and utilized the vendor’s own credentials to gain unauthorized entry into Microsoft 365 (M365) environments belonging to the MSPs’ clients. Because this backup software requires extensive permissions to function—including access to SharePoint, OneDrive, Teams, and mailbox directories—the compromise grants attackers a significant foothold within infected tenants.
Security researchers at Huntress identified that the threat actors utilized these compromised credentials to obtain Microsoft Graph tokens. These tokens allow an adversary to operate with the same privileges as the backup service itself. The attackers demonstrated a methodical approach, moving through customer tenants in a sequence that suggests automated scripting. By leveraging the existing trust and consent framework of the application, the actors bypassed standard authentication barriers that might otherwise block an external intruder.
Escalation Through Privilege Manipulation
The risk associated with this breach extends beyond simple data access. Analysis of the incident revealed that in several instances, the attackers used the initial access to further elevate their standing within the compromised networks. In at least one documented case, an application linked to the ConnectWise environment attempted to assign itself Global Administrator privileges. Once these rights were acquired, the threat actors executed scripts to modify other trusted security and management applications within the tenant.
By adding new client secrets to secondary, highly privileged management tools, the attackers effectively created a backdoor that persists even if the primary ConnectWise application is restricted. This secondary layer of access is particularly dangerous because these management tools are often trusted by other customer tenants in an MSP’s portfolio. Consequently, a breach contained within a single client’s environment possesses the potential to branch out and affect a broader array of organizations, turning a localized incident into a widespread supply chain threat.
Technical Indicators and Detection Challenges
For organizations assessing their exposure, the nature of this attack presents a distinct detection challenge. The backup application typically requires broad access to the Microsoft Graph API, meaning legitimate activities often mirror the behavior of the attackers. However, forensic analysis of sign-in logs in the Microsoft Entra Admin Center has provided specific indicators of compromise (IoCs).
The primary indicator is unusual sign-in activity originating from an IP address identified as 144.172.64[.]128. Under normal operating conditions, the ConnectWise Cloud Backup service utilizes Azure-based private IPv6 addresses for its communication. Any authentication requests stemming from outside these standard network ranges, specifically the identified suspicious IP, should be treated as unauthorized. Furthermore, security teams are encouraged to monitor the “Service principal sign-ins” tab in their logging software, filtering specifically for the application ID 506e08f9-6e9a-4da4-942b-a099a03644ae, which corresponds to the ConnectWise Cloud Backup tool.
Mitigation and Immediate Remediation Steps
ConnectWise has taken the decisive action of disabling the Cloud Backup application’s access to prevent further unauthorized token issuance while remediation efforts proceed. However, simply disabling the application is insufficient to address the entire scope of the threat. Tokens that were issued prior to the application being taken offline can remain valid for up to 90 minutes, and the potential existence of secondary backdoors created via added credentials must be addressed.
IT administrators and MSPs are advised to conduct a thorough audit of their M365 environments. This process includes searching for any new credentials added to service principals since October 13, 2026, and reviewing Entra audit logs for any instance where the ConnectWise or SkyKick applications were granted directory roles. Because certain Graph API activities leave no standard audit trail, organizations should prioritize a proactive review of all privileged application permissions. Revoking existing sessions and rotating secrets for any potentially affected applications is a necessary measure to ensure that the environment has been fully sanitized.
Broader Implications for Supply Chain Security
The ConnectWise breach follows a concerning trend of sophisticated supply chain attacks, appearing concurrently with other incidents such as the ephemeral tampering of AOMEI Backupper servers. These campaigns underscore the vulnerability of the ecosystem surrounding management software. Because MSPs and their clients rely on these third-party tools to automate complex tasks, the software represents a high-value target for threat actors. If a single vendor’s credential management fails, the security posture of every tenant that has granted that software “consent” is compromised.
This incident serves as a reminder of the “least privilege” necessity. While automated backup and management tools require deep access, the aggregation of these permissions in a single service principal creates a systemic point of failure. Moving forward, the industry is likely to see increased scrutiny regarding how these applications store, rotate, and secure their own authentication tokens. Organizations must remain vigilant, treating their third-party software integrations as an extension of their own infrastructure and applying the same level of rigorous audit and monitoring to these vendor-provided tools as they do to their internal user accounts.
Disclaimer: This content is auto-generated for informational purposes only.
Source: Read Original News
