Compromised ConnectWise Credential Abused to Breach 173 Microsoft 365 Tenants
Threat actors are exploiting a stolen credential from ConnectWise Cloud Backup to infiltrate customer Microsoft 365 environments. Security teams must review third-party app permissions and enforce strict access controls.
TL;DR
- Attackers used a compromised ConnectWise Cloud Backup credential to access 173 Microsoft 365 tenants.
- The breach highlights risks of third-party app integrations and excessive permissions.
- Organizations should audit M365 app access and implement zero-trust principles immediately.
- Security researchers recommend rotating credentials and enabling multi-factor authentication.
- Managed service providers (MSPs) are particularly at risk due to their broad system access.
Cybercriminals have launched a widespread attack by leveraging a compromised Microsoft 365 credential linked to ConnectWise Cloud Backup, a service widely used by managed service providers (MSPs). This credential provided unauthorized access to at least 173 distinct Microsoft 365 tenant environments, raising serious concerns around supply chain risks and identity-based attacks.
The incident underscores the critical need for organizations to monitor and restrict third-party application access within their cloud ecosystems. With attackers increasingly targeting trusted integrations, even a single compromised credential can lead to cascading breaches across hundreds of downstream customers.
How the Attack Unfolded
- Threat actors gained access using a legitimate but compromised credential from ConnectWise Cloud Backup (formerly SkyKick).
- The credential had broad permissions, allowing access to multiple Microsoft 365 services including email and OneDrive.
- No evidence suggests ConnectWise itself was hacked—rather, the credential was likely exposed through poor access management or phishing.
- Once inside, attackers could move laterally across connected M365 tenants without triggering typical alerts.
What Security Teams Should Do Now
- Audit all third-party applications with access to your Microsoft 365 environment.
- Enforce principle of least privilege (PoLP) for all integrated apps and user accounts.
- Enable and require multi-factor authentication (MFA) for all administrative accounts.
- Monitor sign-in logs for unusual activity, especially from unfamiliar IP addresses or geographies.
- Establish a regular cadence for reviewing and rotating API keys and service account credentials.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.