ConnectWise backup credentials exposed multiple Microsoft 365 tenants

ConnectWise has disabled key cloud services and is investigating unauthorized access to customers’ Microsoft 365 environments after a credential tied to its Cloud Backup platform was compromised and used to authenticate into customer tenants, prompting Huntress to identify suspicious sign-ins across 162 organizations.

The activity involved the Cloud Backup application obtaining Microsoft Graph access tokens using a credential associated with ConnectWise’s own tenant. Security firm Huntress has also confirmed unauthorized sign-ins across 162 tenants as of 19:00 UTC on October 16.

Huntress said the application authenticated from the IP address 144.172.64[.]128 on October 15, between 06.13 and 08.34 UTC. The address belonged to a hosting provider, rather than the Azure private IP space from which the application normally communicated. The authentication events were recorded in Microsoft’s sign-in logs.

ConnectWise has acknowledged the activity and has disabled seven application identities on October 17. It also suspended Cloud Backup, along with SaaS Security and Cloud Management. Microsoft did not immediately respond to a request for comment.

The company updated its advisory on October 19 and said it had not observed successful threat activity in the environments it monitors since implementing containment measures, but had yet to establish a timeline for restoring the services.

“Existing backup archives remain encrypted and isolated, and we have no indication that those archives have been compromised,” noted ConnectWise. The October 19 advisory update included two additional IP addresses, 144.172.64[.]99 and 144.172.64[.]60, identified through downstream security monitoring.

Integration credentials used to escalate access

ConnectWise Cloud Backup needs broad permissions to back up and restore customer data across Microsoft 365 services, including Exchange Online, OneDrive, SharePoint and Teams. Huntress said the compromised credential allowed the application to obtain Microsoft Graph tokens in customer tenants without requiring an individual user to sign in.

That application-based authentication does not involve a user password or trigger the multi-factor authentication (MFA) prompt associated with a usual login. The credential lives in the vendor’s own environment, meaning customers could not have generated it through activity in their individual tenants.

Huntress also identified activity involving a second ConnectWise application, Cloud Management for Microsoft Teams, in one partner tenant. According to the security firm, the application assigned itself the Global Administrator role and added credentials to two other applications, including a Huntress application specific to that partner.

The sequence took approximately five minutes, Huntress said, adding that it had not established whether the separate stages of activity were conducted by the same operator.

Service suspensions buy time, but tenant-level checks remain necessary

ConnectWise disabled the seven application identities and revoked certificates associated with affected application connections. The company said those actions prevent new authentication through the disabled connections but do not automatically reverse changes already made inside customer tenants.

Previously issued access tokens may also remain usable until they expire or are otherwise invalidated, it added.

The service disruption extends beyond backups. With Cloud Backup suspended, scheduled backups, access to affected archives, and restoration capabilities remain unavailable. SaaS Security monitoring and alerting, as well as Cloud Management’s user and license management functions, have also been taken offline while remediation continues.

Huntress said its investigation had not confirmed data theft. In the one tenant whose audit logs it examined in detail, the firm found no recorded mail or file access, but warned that this did not prove that no data had been taken. Some Microsoft Graph directory reads do not leave an audit trail, limiting what investigators can establish from available records, it noted.

Both companies have urged partners and customer administrators to review their Microsoft 365 environments. ConnectWise’s guidance calls for checks of application sign-ins, credentials, directory roles, consent grants, policy changes, and possible mailbox forwarding or other persistence mechanisms.