Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Researchers have uncovered an active intrusion campaign that exploits a compromised credential from ConnectWise Cloud Backup to infiltrate 173 Microsoft 365 tenants. The breach demonstrates how a single stolen account can cascade across dozens of organizations that rely on a shared backup platform. Understanding the mechanics of this attack is essential for any business that outsources data protection to managed service providers.
Supply‑Chain Credential Compromise via ConnectWise Cloud Backup
ConnectWise Cloud Backup, formerly known as SkyKick, provides cloud‑based backup and recovery services to managed service providers (MSPs). The attackers obtained a valid Microsoft 365 credential belonging to this service, turning a trusted supply‑chain component into an entry point. By leveraging the credential, they bypassed the usual perimeter defenses that protect individual customer environments.
The incident highlights a fundamental risk: when a third‑party platform holds privileged access to multiple client tenants, a breach of that platform can grant attackers a “master key.” This dynamic is especially dangerous in the SaaS era, where shared services are commonplace. Organizations must therefore treat the security of their vendors with the same rigor applied to internal assets.
Scale of the Breach and Its Impact on MSP Clients
The campaign affected 173 Microsoft 365 tenants, a number that reflects both the breadth of ConnectWise’s customer base and the depth of the credential’s permissions. Each compromised tenant potentially exposes email, files, and collaboration tools used by thousands of end users. The ripple effect can extend beyond the immediate breach, as compromised accounts may be used to harvest additional credentials.
For MSPs, the fallout is twofold: they must address the direct intrusion into their own infrastructure, and they must reassure their clients that their data remains secure. The breach also forces a reevaluation of the trust model that underpins many MSP‑client relationships, where a single service provider often holds administrative rights across multiple customer environments.
Attackers’ Tactics: Credential Reuse and Lateral Movement
The threat actors did not need to develop custom exploits; they simply signed in to each tenant using the stolen Microsoft 365 credential. This approach relies on the credential’s inherent privileges, allowing immediate access without triggering typical anomaly detection that looks for unusual exploit behavior. Once inside, the attackers can enumerate users, extract data, or implant additional backdoors.
Because the compromised account belongs to a backup service, it likely possesses broad read/write permissions across the tenant’s data stores. Such permissions enable rapid lateral movement, making it possible to compromise additional accounts or exfiltrate large volumes of information before detection. The simplicity of the method underscores how valuable a single privileged credential can be in a cloud‑centric environment.
What This Actually Means For You
- Any organization that relies on ConnectWise Cloud Backup should assume its Microsoft 365 tenant may be exposed until the credential is revoked.
- Shared administrative accounts across multiple tenants amplify risk; a breach of one service can cascade to all connected customers.
- Monitoring sign‑in activity for anomalous locations or devices becomes critical when a third‑party credential is known to be compromised.
- Enforcing multi‑factor authentication on all privileged accounts, including service accounts, can mitigate the impact of credential theft.
- Regularly rotating service credentials and limiting their scope reduces the attack surface presented by backup platforms.
Immediate Action Steps
Begin by reviewing Azure AD sign‑in logs for any activity originating from ConnectWise Cloud Backup service accounts, especially logins to unfamiliar IP ranges. If suspicious sessions are identified, immediately revoke the affected credentials and enforce a password reset for all service accounts.
Simultaneously, enable multi‑factor authentication for any accounts that possess backup or administrative privileges. Conduct a focused audit of third‑party access permissions, ensuring that each external service holds only the minimum rights required for its function.
Frequently Asked Questions
How did the hackers gain access to 173 Microsoft 365 tenants?
The attackers used a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup, signing in directly to each tenant without needing additional exploits.
What role does ConnectWise Cloud Backup play in this breach?
ConnectWise Cloud Backup provides backup services to MSPs; its privileged credential was stolen, turning the service into a conduit for unauthorized tenant access.
Can multi‑factor authentication prevent this type of attack?
Enabling multi‑factor authentication on the compromised service account would have required a second verification step, likely blocking the attackers from signing in with the stolen password alone.
What Do You Think?
Given the ease with which a single stolen credential compromised dozens of tenants, should organizations reevaluate the level of trust placed in third‑party backup services?