A breach at an IT management vendor reached Microsoft 365 tenants. What to ask your IT provider

ConnectWise sells software that IT providers use to run their own businesses and to manage their customers' systems. One of its products, Cloud Backup, formerly known as SkyKick, backs up data held on premises, in the cloud and in services such as Microsoft 365 and Google Workspace. The Register reported on 19 October that ConnectWise had identified unauthorised access to application identities in the Cloud Backup environment on 15 October, and had suspended Cloud Backup and two integrated services, SaaS Security and Cloud Management.

What it meant for customers

According to The Register, the services were still unavailable at 16:00 UTC on 18 October, which meant end users could not back up data, reach their archives or restore. ConnectWise's vice president of security operations, Jason Ferguson, wrote that existing archives remained encrypted, isolated and preserved, with no evidence of unauthorised access. The Register notes that the suspension did not mean customers should assume their environments had been compromised. ConnectWise asked its customers to check the Microsoft 365 environments they manage for signs of compromise.

What Huntress and Microsoft found

The security firm Huntress said a Microsoft 365 credential belonging to ConnectWise Cloud Backup had been compromised and was being used to get into customers' Microsoft 365 environments. In one tenant, it said, a second ConnectWise application gave itself Global Administrator and added new credentials to two other applications. Huntress warned that disabling the affected apps will not remove credentials already added, and that the credentials on all Microsoft 365 applications need reviewing. On 22 October The Register reported Microsoft's findings: a China linked group it tracks as Storm-0940 used the compromised ConnectWise application credentials, and an open source AI penetration testing tool called ARTEX, to attempt to authenticate against more than 2,250 Microsoft 365 tenants, at times at 2,900 attempts a minute. Microsoft says most attempts failed, but that the attackers established persistent privileged access at numerous organisations. It has not said how many, or whether any data was taken.

Why this is hard for the businesses at the end of the chain

Microsoft says the compromised credentials let the attackers use permissions that customers had already granted to ConnectWise's services, without needing anyone to log in. The Register also points out that IT providers are under no obligation to tell customers which platforms they use, so many businesses would not know whether they were exposed. ConnectWise's chief executive, Manny Rivelo, said the affected connections had been contained and services were being restored gradually, but that shutting them down would not necessarily remove attackers who had already got a foothold.