ConnectWise and the hidden risk in Microsoft 365 backups.
The ConnectWise Cloud Backup compromise shows why the safest secret is the one that no longer exists.
On October 15, a script worked through a sorted list of Microsoft 365 tenants, presenting one credential to Microsoft Entra ID every few seconds and requesting an access token for each. The credential belonged to ConnectWise Cloud Backup, formerly SkyKick, and it worked wherever an organization had approved the app. No password was guessed and no MFA prompt appeared, because the script was signing in as the backup application itself.
How the ConnectWise cloud backup attack worked
ConnectWise Cloud Backup, formerly SkyKick, is a multi-tenant application. Organizations that enable it can grant the application access to mailboxes, OneDrive, SharePoint, Teams and directory data without requiring a user to be signed in. Because the unauthorized sign-ins were application-based, user-focused protections such as Conditional Access did not necessarily apply. Huntress confirmed unauthorized sign-ins across 162 tenants and later identified activity from the attacker's IP address across nearly 1,000 tenants, with more than 300 successful sign-ins.
ConnectWise has since disabled affected application identities, suspended several cloud services and begun replacing credentials. The original source of the compromised credential remains under investigation.
What Microsoft 365 data may have been exposed?
Backup applications require broad access because they need to copy data across Microsoft 365, including email, SharePoint files, Teams conversations and other information stored throughout an organization. Investigators have confirmed unauthorized access but have not determined exactly what information was taken. ConnectWise has reported no evidence that stored backup archives were accessed, but that does not rule out exposure inside live Microsoft 365 environments.
Years of email and chat history can contain information that was only meant to be temporary, including passwords shared during onboarding, API keys, Wi-Fi credentials, identification documents or internal support processes. Even conversations without credentials can reveal who approves resets, which MSP handles support and how employees expect those requests to happen, giving attackers useful context for future impersonation attempts.
ConnectWise remediation creates another security risk
Revoking the original credential does not automatically undo changes made while an attacker had access. Huntress identified two tenants where a ConnectWise application granted itself Global Administrator privileges and added new client secrets to other trusted applications, meaning those secrets could continue working until discovered and removed. Organizations now need to review application credentials, permissions and administrative roles while rotating affected secrets and monitoring Microsoft Entra activity.
For MSPs, remediation can also create a sudden increase in password resets, new credentials and urgent client requests moving through email and Teams. Sending those new secrets through permanent communication channels can recreate the same long-term exposure organizations are trying to remove. The disruption also creates an opportunity for social engineering because an attacker pretending to be an MSP technician requesting an emergency approval or a client administrator requesting a reset now has a believable reason to contact someone.
Reducing Microsoft 365 credential and impersonation risk
ConnectWise and affected organizations are responsible for rotating compromised credentials, reviewing application permissions and monitoring suspicious service principal activity. Traceless addresses a different part of the problem by reducing what sensitive information remains available when a trusted account or application is compromised.
Traceless Data replaces passwords and keys pasted into tickets, email or Teams with encrypted, expiring links, preventing those secrets from remaining permanently inside conversation history.
Traceless Verify addresses the impersonation risk surrounding remediation by allowing technicians and users to verify each other's identities through their existing MFA tools before resetting an administrator account or approving a sensitive change.
Together, these controls help reduce both the amount of sensitive information available to an attacker and the risk of fraudulent support requests during a security incident.
Prevent social engineering attacks
Start with one integration, validate quickly, and expand across your environment.