ConnectWise’s backup outage shows who holds the keys to Microsoft 365

ConnectWise said on 20 October that its Cloud Backup service, formerly SkyKick, would return in “a controlled, phased restoration”, but gave no date. The update, posted on its Trust Center at 12:45 UTC, came three days after the company cut off the service’s application access on 17 October. Scheduled backups, archive access and restores remain unavailable, as do two sister services, SaaS Security and Cloud Management, which ConnectWise suspended because they are integrated with Cloud Backup.

ConnectWise says it identified “unauthorized access to application identities associated with Cloud Backup” and that existing archives “remain encrypted, isolated, and preserved, with no indication of compromise.” The application identities are the accounts the backup tool and the Cloud Management service use to sign in to customers’ Microsoft 365 tenants, the separate environments in which each organization keeps its email, files and Teams data.

Huntress, a security company that sells managed detection and response to managed service providers, published a technical account on 16 October. It said “A Microsoft 365 credential (API secret) belonging to ConnectWise Cloud Backup (formerly SkyKick) has been compromised” and confirmed unauthorized sign-ins in 162 tenants by 19:00 UTC that day. In a later update it reported almost 1,000 Entra tenants with sign-in activity from the attacker’s IP address, more than 300 of them successful.

For mid-market firms that buy Microsoft 365 backup through an IT provider, the incident shows how much access that purchase carries. The tool bought to protect the data holds broad standing access to it, multi-factor authentication does not cover that access, and the vendor says it cannot see what happened inside each customer’s tenant.

The reach of a backup key

Huntress sets out the reach plainly: “Because backup and restore both need to read and write data, those permissions are broad.” An attacker holding the app’s tokens can read the same mailboxes, files and directory data the backup service can, it says.

Multi-factor authentication does not stand in the way. “Multi-factor authentication (MFA) doesn’t apply because this is an application sign-in,” said Justin Kohler, chief product officer at SpecterOps, in comments reported by Infosecurity Magazine. ConnectWise’s own guidance makes a similar point about Microsoft’s Conditional Access rules: “User policies do not automatically protect application-only authentication.”

In one tenant Huntress examined, the access went further. Early on 15 October the ConnectWise Cloud Management app for Microsoft Teams added itself to the Global Administrator role, then added new client secrets to two other applications in the tenant, an MSP management tool and Huntress’s own security app. The whole sequence took about five minutes, according to Huntress, and the new secrets were set to expire in 2028.

The limits of the vendor’s view

ConnectWise has been direct about the limits of its own investigation. “By design, the configuration of Cloud Backup does not provide us visibility or access to downstream partner and customer environments,” it said on 17 October. Its 20 October update adds that its monitoring since 17 October “does not establish whether individual partner or customer Microsoft 365 tenants were affected; each potentially affected tenant still requires review.”

Shutting off the vendor’s credential does not undo what was done with it. ConnectWise disabled seven application identities at 07:00 UTC on 17 October and said that step “does not reverse changes previously made inside a tenant.” Huntress says disabling the apps “will not remove credentials that were already added.” How the original credential was exposed remains under investigation, according to ConnectWise, which says it cannot discuss attribution.

The review therefore falls to whoever administers each tenant, often the firm’s managed service provider. ConnectWise has asked partners to check their own tenant and every customer tenant they manage, including those with dormant SkyKick connections, and has asked resellers, distributors and marketplace partners to make sure the guidance “reaches responsible customer administrators.” It scheduled technical webinars for partners every two hours from 18:00 UTC on 20 October.

A seven-day clock on the evidence

That review depends on logs, and some of them are short-lived. ConnectWise’s guide notes that Entra “normally retains audit and sign-in records for seven days on Free and 30 days on P1/P2”, and that “A license upgrade does not recover expired history.” Huntress traces the earliest activity it saw from the attacker’s address to password spraying against four law firm tenants on 13 and 14 October. On the free tier, records from 13 October passed the seven-day mark on 20 October.

Even complete logs leave gaps. Huntress says Microsoft “does not log everything an application reads”, so it could not rule out access to data in the tenant it studied. ConnectWise’s guide concedes that “a clean search cannot rule out activity that was not captured in the available logs.”

Backups paused, questions open

While the suspension lasts, firms on the service have no new backups of their Microsoft 365 data through it. ConnectWise’s guide asks partners to check the last successful recovery point and “assess the protection gap while services are unavailable.” Its FAQ says it has “not identified confirmed downstream customer compromise”, but that “the absence of confirmed compromise is not assurance that no unauthorized activity occurred.”

Three days after the shutdown, ConnectWise says its investigation cannot see past its own environment. What happened inside each Microsoft 365 tenant is left to the firm that owns it and the provider that runs it, and on Microsoft’s free tier the evidence for the first days of the attack is already expiring.