The Vendor You Forgot You Trusted: The ConnectWise Cloud Backup Attack
Quick question. How many apps have permission to read, write or administer stuff in your Microsoft 365 tenant right now? If your honest answer is "uhh", congrats, you're normal. You're also exactly who this story is about.
What happened (and what's confirmed)
On Oct 16, ConnectWise disclosed that application identities in its Cloud Backup product (formerly SkyKick) were accessed on Oct 15. It suspended Cloud Backup, SaaS Security and Cloud Management while it looked into it. Those two things, the compromise and the suspension, are confirmed by ConnectWise.
Then on Oct 21, Microsoft published its read on it. This part is an assessment, not a settled fact, so keep the label on it. Microsoft attributes the activity to a group it calls Storm-0940, which it describes as China-aligned, and says the group used an open-source agentic pentest framework called ARTEX. "Agentic" just means AI that takes actions on its own, step after step, instead of waiting for a human to click.
What Microsoft says it saw:
Sign-in attempts against more than 2,250 tenants.
Privileged cloud access in under 3 hours in some cases.
ConnectWise has said it cannot discuss attribution. Microsoft also notes that a successful authentication in a tenant does not prove data was accessed. So "2,250 tenants" means attempted sign-ins, not 2,250 breached companies. One more thing: a "173 tenants" number is floating around on a less established site. It wasn't verified, so skip it.
The scary detail: disabling the app isn't enough
Huntress reported seeing a ConnectWise app grant itself Global Administrator, then add credentials to other apps. Those added credentials survive even if you disable the original app.
Read that twice. Turning off the vendor app felt like the fix. It might not be. The attacker's foothold can live in credentials added to other apps.
Who this touches
Any Microsoft 365 tenant that ever authorized the ConnectWise apps. And here's the sneaky part: that often happened through an MSP (a managed service provider, the outside IT company that runs stuff for you). The end customer may have no idea the app exists. It's the vendor you forgot you trusted, or never knew you trusted in the first place. If you're weighing when a growing company actually needs outside security leadership, this is the kind of blind spot that person catches.
Why OAuth apps are the weak spot
When you connect a third-party app to Microsoft 365, you usually click "Accept" on a permissions screen. That's OAuth. After that the app holds its own identity and permissions, no password prompt, no MFA nag. If its permissions are broad, whoever controls the app controls that access.
That's a trust path attackers can take at machine speed. Add AI agents and the "attacker needs time to poke around" assumption gets shaky. A separate report (Reuters, Oct 19, which I'm relaying from its summary and secondary coverage) describes one hacker using autonomous AI agents to attempt about 1,200 break-ins and compromise more than 100 sites for roughly $5,000 in tokens. Direction of travel: cheaper and faster for attackers.
What an OAuth app review looks like
You don't need a fancy tool. You need an hour and admin access, or an MSP who'll do it with you. Do this:
List every enterprise app and service principal in your tenant. In Microsoft 365 that's Microsoft Entra. A service principal is just the app's identity inside your tenant.
For each one, ask three things. Do we know what it is? Do we still use it? Who approved it?
Check what permissions it has. Anything with broad access (mail, files, directory, admin roles) needs a real reason to exist.
Look at who consented and how. Did a person approve it, or did an MSP do it on your behalf?
Remove what you don't use. Dead apps are free real estate for attackers.
Look for credential additions. Check whether anyone added new secrets or certificates to apps, and when.
Check role assignments. Look for apps that were handed admin roles, especially recent ones.
Write down an owner for each app that stays. If nobody owns it, it gets forgotten again.
If you or your MSP used ConnectWise Cloud Backup: do this now
Search Entra by the ConnectWise application ID.
Review service principal credential additions and role assignments from Oct 1 onward.
Ask your MSP whether these apps were ever authorized in your tenant.
And since disabling the app may not remove credentials already added, don't stop at "we turned it off."
The takeaway
Vendors will get hit sometimes, like the Canvas breach showed. What you control is how much trust you've already handed out and whether you still know about it. It's the same lesson as you can't patch what you don't know you run. Do the review, even if it's boring. Especially if it's boring.
Comments