/
← Voltar ao feed
critical technology managed_service_providers

ConnectWise suspends Cloud Backup, SaaS Security and Cloud Management after attackers access Microsoft 365 application identities

1 fonte(s) · 1 atualização(ões) · publicado 19/10/2026 07:30 · coletado há 6 horas

ConnectWise took several cloud services offline, including Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management, after finding unauthorized access to application identities in the ConnectWise Cloud Backup environment. The company began investigating suspicious activity on October 15 and confirmed the unauthorized access by October 17. Attackers could potentially use these application credentials to reach customers' Microsoft 365 tenants with the permissions granted to the backup app. Huntress observed that in at least one customer tenant the attacker assigned themselves the Global Administrator role and tried to change permissions for other applications. ConnectWise reports no indication yet that partner backup data was compromised, has no restoration time and declined to discuss attribution.

Technical Details

  • The attacker authenticates as the application itself, using the tenant tooling the same way the backup service would, and obtains tokens carrying the app's existing permissions.
  • This is an application sign-in, so MFA does not apply. As Justin Kohler (SpecterOps) noted, no user, device or MFA prompt is involved.
  • Backup apps typically have broad read/restore access to mailboxes, OneDrive and SharePoint files, Teams data and directory information.
  • Huntress saw a Global Administrator role self-assigned in at least one tenant, followed by attempts to modify permissions of other applications, including an MSP management application and Huntress's own security application.
  • No attribution has been made, and no IOCs were published in the article.

Remediation

  • Verify the status of the listed application connections and keep affected applications disabled until ConnectWise provides restoration instructions.
  • Preserve sign-in and audit records promptly, while taking any urgent containment action.
  • Review application and user authentication, application credentials, federation trusts, directory roles, owners, consent grants and recent policy changes.
  • Check for unauthorized mailbox forwarding, inbox or transport rules and delegated mailbox access.
  • Investigate other identities changed or used during suspicious activity; disabling the original applications does not remove those separate access paths.

Linha do tempo

  1. infosecurity-magazine.com ↗ · pub. 19/10/2026 07:30 · coletado 20/10 16:31 primeiro registro

    ConnectWise suspends Cloud Backup, SaaS Security and Cloud Management after attackers access Microsoft 365 application identities

    ler a análise desta fonte

    ConnectWise took several cloud services offline, including Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management, after finding unauthorized access to application identities in the ConnectWise Cloud Backup environment. The company began investigating suspicious activity on October 15 and confirmed the unauthorized access by October 17. Attackers could potentially use these application credentials to reach customers' Microsoft 365 tenants with the permissions granted to the backup app. Huntress observed that in at least one customer tenant the attacker assigned themselves the Global Administrator role and tried to change permissions for other applications. ConnectWise reports no indication yet that partner backup data was compromised, has no restoration time and declined to discuss attribution.

    Technical Details

    • The attacker authenticates as the application itself, using the tenant tooling the same way the backup service would, and obtains tokens carrying the app's existing permissions.
    • This is an application sign-in, so MFA does not apply. As Justin Kohler (SpecterOps) noted, no user, device or MFA prompt is involved.
    • Backup apps typically have broad read/restore access to mailboxes, OneDrive and SharePoint files, Teams data and directory information.
    • Huntress saw a Global Administrator role self-assigned in at least one tenant, followed by attempts to modify permissions of other applications, including an MSP management application and Huntress's own security application.
    • No attribution has been made, and no IOCs were published in the article.

    Remediation

    • Verify the status of the listed application connections and keep affected applications disabled until ConnectWise provides restoration instructions.
    • Preserve sign-in and audit records promptly, while taking any urgent containment action.
    • Review application and user authentication, application credentials, federation trusts, directory roles, owners, consent grants and recent policy changes.
    • Check for unauthorized mailbox forwarding, inbox or transport rules and delegated mailbox access.
    • Investigate other identities changed or used during suspicious activity; disabling the original applications does not remove those separate access paths.