Last week’s ConnectWise Cloud Backup incident did not start with a phished employee in your organization. According to Huntress, attackers signed in to Microsoft 365 tenants as the backup application itself, using a credential held by the vendor. No user, no device, no MFA prompt. If your security program stops at user accounts, this is the gap it describes.
What happened
Huntress traced scripted activity from a single hosting IP starting October 13 and 14. By October 15, ConnectWise Cloud Management service principals had started assigning themselves directory roles, mostly Exchange Administrator, in about 50 tenants Huntress monitors. In one tenant, the Cloud Management Teams app added itself to Global Administrator and then modified two other applications. Huntress confirmed unauthorized sign-ins in 162 tenants as of October 16 and later reported roughly 1,000 tenants with sign-in activity from the attacker’s address, more than 300 of them successful.
Counts differ by source and keep moving, and the final number is still unclear. BleepingComputer reported that ConnectWise announced a Cloud Backup interruption on October 17 and disabled seven application identities. The company said it had no indicators that partner backup data was compromised. How the credential was obtained has not been disclosed.
Why MFA and user controls did not help
Cloud Backup is a multi-tenant app. Each customer consented to it once, and that consent granted standing permissions inside their tenant. Microsoft described the event as an active supply-chain attack and assessed that the actor likely abused permissions customers had previously granted, according to Cybersecurity Dive. Because the sign-ins were app-only, user MFA and user-session revocation never entered the picture. Todyl, quoted by BleepingComputer, noted that disabling an app stops new tokens, while tokens already issued can stay valid until they expire.
Persistence is the part that should worry a CIO. In at least one tenant, Huntress found client secrets planted on other applications, including an MSP management tool and Huntress’s own app, set to expire in 2028. Disabling the ConnectWise apps does not remove credentials that were already added elsewhere.
The recovery problem
This was a backup product. As of ITPro‘s October 20 report, Cloud Backup remained disabled with no confirmed restoration date. A tool bought to reduce recovery risk became a dependency on one vendor’s identity, and while it is off, scheduled backups are not running.
A third-party app audit you can start this week
- Inventory every enterprise application with consent in your tenants, including dormant ones. Huntress advises disabling, not deleting, the implicated ConnectWise and SkyKick apps, since deleting removes consent and forces a re-consent to restore service.
- Review client secrets and certificates on all applications for anything added since October 13 that your team did not create. Check management and security tools first.
- Look at directory roles held by service principals. Any vendor app holding Global Administrator or Privileged Authentication Administrator needs an owner and a written reason.
- Search Entra audit and service principal sign-in logs for apps modifying other apps or assigning themselves roles, and for sign-ins from non-Microsoft IP ranges.
- Put guardrails in place: application management policies to restrict or cap client secret lifetimes, tighter control over who holds Application Administrator roles, Conditional Access for workload identities, and Entra ID Protection for risky service principals. Huntress lists these as hardening steps.
Then ask the question that this incident makes uncomfortable: if your backup vendor’s identity were unavailable tomorrow, how would you restore a mailbox? A recovery path that depends on a single vendor’s identity is a plan with a hidden single point of failure.
Treat vendor apps like privileged users
Admin accounts usually get access reviews. OAuth apps with similar reach often do not. The ConnectWise incident is a reminder that consent is a standing grant, and it can be exercised by whoever holds the vendor’s credential. Give each third-party app an owner, a permission review date and an exit plan.
Reviewing your third-party access or recovery architecture? Talk to the Luby team about a practical assessment.