The sign-ins did not look like a break-in. They looked like a trusted backup tool doing its job, authenticating to one customer’s Microsoft 365 tenant after another, a few seconds apart, in neat sorted order. Only the source gave it away: a hosting-provider address, 144.172.64[.]128, that had no business acting as ConnectWise Cloud Backup.

Five days on, ConnectWise has switched off the service, and customers who relied on it to protect their email and files cannot back up or restore anything.

What happened on October 15

ConnectWise Cloud Backup, formerly known as SkyKick, is a tool managed service providers use to protect Microsoft 365 and Google Workspace data. To do that, the app is granted sweeping access to mailboxes, OneDrive, SharePoint, Teams and directory information in every tenant where it is installed.

According to Huntress, the security firm that documented the intrusion, the app’s own identity signed in to customer tenants starting at 06:13 UTC on October 15, collecting Microsoft Graph tokens as it went. Microsoft separately reported broad, successful service-principal authentication from the same address that day.

The detail that makes this incident different is the type of credential involved. The sign-ins relied on a client assertion, which means the proof of identity originated in the vendor’s own tenant. No customer password was guessed and no multifactor prompt was bypassed, because the attacker was authenticating as the application itself. Nothing an administrator at a victim organization did, or failed to do, could have produced it.

Jonathan Semon of Huntress put the consequence in a single line in the company’s October 16 post: “The app’s credential is in hostile hands.” The Huntress write-up has been updated as the picture has developed.

What the attacker did next

Microsoft says the intruder ran reconnaissance through Graph and tried to attach new credentials to related service principals, a classic way to leave a backdoor behind. In its public warning, Microsoft Threat Intelligence called the episode an “active supply chain attack.”

Huntress described a particularly fast sequence in two tenants it examined. An application granted itself Global Administrator rights and planted fresh secrets on several other apps, all within about five minutes. Those secrets were set to expire in 2028, suggesting whoever created them wanted a long runway. The security community tracks this technique as Additional Cloud Credentials in the MITRE ATT&CK framework.

One caution applies to that finding. The administrator-level activity began around 03:45 UTC, well before the 06:13 UTC sign-ins, and Huntress has not established that the same operator was behind both phases.

How big is the exposure?

The numbers have moved, and they need careful reading. Huntress confirmed unauthorized sign-ins in 162 tenants as of 19:00 UTC on October 16. By its October 17 update, almost 1,000 tenants showed sign-in activity from the attacker’s address, and more than 300 of those attempts succeeded.

A successful sign-in is not the same as stolen data. Huntress has not said that every one of those tenants lost information, and headlines suggesting 300 compromised companies go further than the evidence does. By October 19, Huntress said it had seen sign-in activity only from the attacker’s address and Microsoft’s own internal ranges, across more than 10,000 tenants running ConnectWise apps.

Huntress also reported a second wave aimed at 16 tenants in policy, national security, trade and critical minerals. Those attempts failed. That targeting comes from Huntress’s own telemetry, so it should be read as one firm’s view rather than an independently confirmed pattern.

On the question every customer wants answered, the evidence is reassuring but incomplete. ConnectWise says it has no indicators that partner backup data was compromised, and Huntress saw no mailbox or file manipulation in the two tenants it reviewed. Huntress also points out that directory reads through Graph leave no audit record, so access cannot be ruled out.

The backups went dark

At 07:00 UTC on October 17, ConnectWise disabled seven application identities. Cloud Backup, SaaS Security and Cloud Management were suspended, and as of 16:00 UTC on October 18, users could not back up data, reach archives or restore anything. The company’s status page has carried the updates.

The sharpest irony is hard to miss. A product sold as a safety net is now offline at the moment its customers would most want reassurance. On October 19, ConnectWise told customers: “We do not yet have a confirmed restoration time.”

Why this one is hard to unwind

Supply chain attacks work because they borrow trust. Here, the borrowed asset was an application customers had already authorized, and its credential worked against every tenant where that consent existed. Defenses built around user logins have little to say about an app signing in as itself.

There is also a visibility problem. ConnectWise cannot see inside customer tenants and relies on managed service providers to investigate their own environments. Many end-user organizations may not even know their provider uses ConnectWise, which means some may not yet know there is anything to check.

The Register has drawn a comparison to the 2021 Kaseya attack, the best-known earlier case of an MSP platform being used to reach downstream customers. The parallel is imperfect, but the shape is familiar: compromise one vendor, inherit access to many.

What remains unknown

Several basic questions are still open. ConnectWise says it cannot discuss attribution at this time, and no threat actor has been publicly named. How the credential was obtained has not been confirmed. Investigation and remediation are ongoing, and Huntress has said it will keep updating its findings.

Huntress has its own stake in the story. An unauthorized credential was planted on one of its applications in a partner tenant, and the company sells security products, so its findings are best read with that context in mind. Neither ConnectWise nor Microsoft has contradicted its core account.

For administrators, the practical work is to review enterprise app registrations and service principals for unfamiliar credentials, paying attention to secrets with distant expiry dates. For everyone else, the thing to watch is how long the outage lasts and whether ConnectWise, Microsoft or a regulator eventually explains how a vendor’s own credential ended up in the wrong hands. Until it does, every customer of an app with this much reach is left trusting a vendor to tell them what its own tenant cannot show.