How Attackers Used a Compromised ConnectWise Credential to Access 173 Microsoft 365 Environments

Researchers discovered that threat actors obtained valid login credentials for a ConnectWise Cloud Backup account and used them to sign into 173 separate Microsoft 365 customer environments without authorization. ConnectWise Cloud Backup (formerly known as SkyKick) is a cloud-native backup and disaster-recovery platform marketed specifically to managed service providers and enterprises. The service is designed to give MSPs delegated administrative access to their customers' Microsoft 365 tenants so they can protect data, manage backups and respond to incidents. When attackers compromised the ConnectWise credential, they inherited that same broad access across all enrolled customer accounts. The attack appears to be ongoing and active, meaning the credential remained valid and usable during the investigation period.

Managed service providers act as security gatekeepers for thousands of small and mid-sized businesses that lack in-house IT teams. MSPs like ConnectWise hold the keys to customer environments: email, files, collaboration tools and often financial and operational data. A single compromised third-party credential therefore becomes a master key to dozens or hundreds of downstream victims. This is not a case of the attackers hacking 173 companies individually. Instead, they compromised one trusted intermediary and instantly gained entry to everyone that intermediary serves. For enterprises, the lesson is equally stark: every SaaS vendor, backup provider and security tool granted administrative access represents a potential single point of failure in your defense.

The most probable scenario is that attackers obtained the compromised ConnectWise credential through one of several common pathways. The credential may have been stolen from a compromised MSP employee workstation, harvested from a phishing email, exposed in a data leak, or obtained via credential-stuffing attacks on recycled passwords. Once in possession of valid credentials, the attackers used standard authentication mechanisms to log into the ConnectWise platform and then directly into customer Microsoft 365 tenants using the delegated permissions that ConnectWise held. No zero-day exploit or sophisticated technical attack was necessary. The attackers simply signed in as though they were authorized support staff. This method leaves audit trails showing logins from the ConnectWise IP space or account, which can initially mask the intrusion as routine service activity.

Several structural factors make this type of attack inevitable in the current cloud-security landscape. First, delegation of administrative credentials is deeply embedded in how cloud services operate: a backup vendor, monitoring tool or security firm cannot do its job without read-access or administrative access to the systems it protects. Second, password and credential theft remains cheap and effective; data breaches and credential markets make valid login details widely available to motivated attackers. Third, many organizations reuse credentials across multiple systems or store them in insecure note-taking tools, making a single compromised account a gateway to multiple platforms. According to public law-enforcement advisories and security-vendor incident reports, supply-chain attacks targeting MSPs have grown significantly because the return on investment is extremely high: compromise one service provider and gain access to hundreds of customers. The reason this matters to ordinary users is that their data often lives in accounts their company has delegated to a third party, and that person has little visibility into whether that third party's own security has been compromised.

Organizations that use ConnectWise Cloud Backup or any third-party service with Microsoft 365 access should take the following actions:

1. Check Microsoft 365 audit logs for any sign-in activity from the ConnectWise account during the suspected breach window; look for logins outside normal business hours or from unexpected geographic locations.

1. Force password resets for all Microsoft 365 administrators and any account that could grant access to sensitive data, particularly if those credentials were reused on other systems.

1. Review forwarding rules and transport rules in Exchange Online; attackers often create hidden forwarding rules or mail rules to exfiltrate email after gaining initial access.

1. Request a detailed incident report from ConnectWise or your MSP detailing exactly which accounts were accessed, when, and what data was viewed or modified.

1. Enable Microsoft Entra ID (formerly Azure AD) conditional access policies to restrict sign-ins for critical accounts to known IP ranges or device profiles, limiting the utility of stolen credentials in the future.

1. Verify that multi-factor authentication (MFA) is enforced for all administrative accounts, particularly for any account that holds delegated permissions from third-party tools.

This incident illustrates why no single vendor or tool should be treated as an absolute trust boundary. Even if ConnectWise itself maintains excellent security practices internally, the moment an employee credential is compromised, that perimeter fails. The practical implication is that organizations should assume any third-party credential in their environment is a potential attack vector and design their access controls accordingly. That means using conditional access policies, IP whitelisting, continuous monitoring of third-party activity, and principle-of-least-privilege assignments. If a backup vendor only needs read-access to certain mailboxes, do not grant it organizational-wide permissions. If a monitoring tool needs visibility into one geographic region, do not let it see all regions. Segmentation and minimization are the most reliable mitigations against supply-chain credential theft.

What should I do if my company uses ConnectWise Cloud Backup but I don't know if we were among the 173 compromised tenants?

Contact your IT department or MSP directly and ask whether your Microsoft 365 tenant was on the list of affected customers. ConnectWise has been providing incident notifications; if you have not heard from your provider, follow up proactively. Do not wait for a formal breach notice.

Does this mean I should stop using ConnectWise or any third-party backup service?

No. Cloud backup is essential for business continuity and data protection. Instead, focus on securing the credential that grants access: use MFA for the backup vendor's account, store the password in a secure vault, restrict which staff can access it, and monitor its usage regularly. The issue is not the product, but how the credential is managed.

If my password was not reused and I have MFA turned on, am I safe from this breach?

If the attackers only held the ConnectWise credential and your Microsoft 365 account is protected by MFA, the attacker would not be able to sign in directly to your account. However, they could still view data if the ConnectWise account itself had access to it, or they could access other accounts in your organization that were not MFA-protected.

What is the difference between this attack and a standard data breach?

In a standard breach, attackers target one company at a time. In a supply-chain attack, they compromise a trusted intermediary and gain access to many companies at once. This breach is a supply-chain attack because the attacker compromised ConnectWise and then accessed customers indirectly through ConnectWise's delegated permissions.

Source: The Hacker News