This one deserves your attention more than most supply-chain stories, because the product involved is sold through managed service providers to small and mid-sized businesses. An attacker obtained the credential belonging to the ConnectWise Cloud Backup application, formerly SkyKick Backup, and used it to sign in to customers' Microsoft 365 environments. Huntress confirmed unauthorized sign-ins across 173 Microsoft 365 partner and customer tenants as of October 17, up from 162 the day before, with activity starting around October 14 to 15. ConnectWise shut off Cloud Backup application access while it investigates and says it has found no evidence that partner backup data was compromised. How the credential was obtained has not been disclosed.
Why your MFA did nothing
The attacker did not log in as a person. They authenticated as the application itself, using the application's own secret. There was no user sign-in, so there was no password prompt and no multi-factor challenge to pass. Everything you have done to protect human logins was simply not in the path.
And because they held the app's identity, they inherited every permission customers had already granted it. Microsoft reportedly flagged Directory.ReadWrite.All among those permissions, which is read and write access to your directory. A backup product legitimately needs broad access to back things up. That is the uncomfortable arithmetic of the whole model: the more useful the integration, the more it is worth stealing.
The part that makes this worse than a vendor advisory
Disabling the affected app is not sufficient. Huntress observed a second ConnectWise application granting itself Global Administrator, and adding new client secrets to two other trusted applications. A client secret is a credential. Adding one to an app you already trust creates a way back in that survives resetting the original credential and keeps working after the obvious door is closed.
That changes the response. It is not install the fix and move on, it is check whether something was established in your tenant while this was happening.
What to actually do, this week
- Open Entra Enterprise Applications in your Microsoft 365 admin portal and look for the Cloud Backup application, application ID 506e08f9. If it is present, disable it.
- Review every other application for recently added credentials. Look at each app's certificates and secrets, and treat anything added in the last week that you cannot account for as a finding.
- Check for new Global Administrators and for any application granted directory write access since mid-October.
- Read the sign-in logs for application sign-ins, not just user ones. This is the category most small businesses have never looked at, and it is where this attack is visible.
- If your IT provider manages your tenant, email them today: do we use ConnectWise Cloud Backup, were we in the affected set, have you reviewed our enterprise applications and app sign-ins, and what did you find. The specificity of the answer tells you a great deal.
- Then do the general version. List every third-party app with consented access to your Microsoft 365 or Google Workspace, what it can reach, and who approved it. Most of these were consented years ago at somebody's request and never revisited.
The broader point
Small businesses have spent several years correctly being told to turn on multi-factor authentication, and it remains the highest-value control available. This incident is a reminder that it protects one specific thing: people logging in. The other door into your tenant is the set of applications you have granted standing access to, and that list is almost never reviewed. It is the same lesson as the RMM platform attacks we have covered, with a sharper edge, because here the attacker never needed to exploit a vulnerability at all. They just used a valid credential for a trusted app.
The takeaway
Ask one question this week: what applications can reach our Microsoft 365, and what are they allowed to do? If nobody can answer it, that is a bigger finding than whether you happened to use this particular backup product. The apps in your tenant are accounts too, and nobody has been checking them.