No user signed in and no MFA prompt was beaten — yet attackers got into Microsoft 365 tenants with the permissions a trusted backup app had been given.

ConnectWise has confirmed unauthorised access to application identities associated with Cloud Backup, its backup service for managed service providers (MSPs) formerly known as SkyKick, which it says it discovered on 14 October. At 07:00 UTC on 17 October it disabled seven application identities, revoked the certificates behind them and suspended Cloud Backup, SaaS Security and Cloud Management. It says its backup archives remain encrypted and isolated; how the credential was exposed is still under investigation. ConnectWise has published the suspicious source IP address 144.172.64[.]128 and the Python scripting user agents seen in the authentication activity. BleepingComputer reports that hackers used the accessed application identities to compromise Microsoft 365 tenants, and that one administrator said on Reddit that a Microsoft Entra Privileged Identity Management alert on 15 October showed a SkyKick service principal assigning itself the Exchange Administrator role, in a tenant that had not used the app in years.

We have spent years hardening the human sign-in. None of it applied here. A backup app signs in as itself, on consent granted once, with what The Hacker News describes as broad access to mailboxes, OneDrive, SharePoint, Teams and directory data. Steal its credential and you inherit that access in every tenant where it is consented. The Entra documentation is explicit that Conditional Access for workload identities covers single-tenant service principals registered in your tenant, not third-party multitenant apps. ConnectWise’s own guidance makes the same point: user policies do not automatically protect application-only authentication, previously issued access tokens may remain usable until they expire, and a clean log search cannot rule out activity the logs never captured.

For APAC organisations, the exposure often sits one step removed. If an MSP runs Microsoft 365 for your regional offices or subsidiaries, a vendor you never contracted with directly may hold standing access to your mail. ConnectWise itself says it cannot determine whether any individual customer tenant saw unauthorised activity, and that disabling its apps does not reverse changes already made. That review is yours.

What security leaders should do:

• Find the seven ConnectWise and SkyKick application IDs in every tenant, including dormant ones, and keep them disabled until ConnectWise issues restoration instructions.
• Export service-principal sign-ins (not the default user tab) and audit logs from 13 October onward before retention runs out, and check them against the IP addresses ConnectWise has published.
• Audit secrets, certificates, federated credentials and directory-role assignments on every app for anything added since 13 October. Credentials an attacker planted survive the vendor’s shutdown.
• Check Exchange for new forwarding, inbox and transport rules and delegated mailbox access, as ConnectWise advises.
• Ask your MSP to list every third-party app holding tenant-wide permissions on your behalf, with an owner for each.

Your most privileged logins don’t belong to people. Treat every app consent like an admin account, because that is what it is.

Disclaimer: This post was researched and written by AI agents working with Philip Sow. Every source is linked so you can check the facts. Views are personal and do not represent any employer.

#IdentitySecurity #Microsoft365 #SupplyChainSecurity #APAC #CyberSecurity

Sources: ConnectWise Trust Center · The Hacker News · BleepingComputer · Microsoft Learn