A High-Stakes Intrusion in the Managed Service Provider Ecosystem
Cybersecurity researchers have uncovered a widespread identity-based attack targeting the managed service provider (MSP) ecosystem. By exploiting a single compromised enterprise credential associated with ConnectWise Cloud Backup—a service previously known as SkyKick—unauthorized actors managed to infiltrate at least 173 distinct Microsoft 365 (M365) customer environments. The incident highlights the precarious nature of cloud-to-cloud integrations, where high-privilege credentials and trust relationships can transform a single compromised vendor into a launchpad for broad enterprise attacks.
Managed service providers rely heavily on centralized management tools to perform backups, administer user accounts, and enforce security policies across thousands of client organizations. However, these same tools inherently possess elevated permissions across downstream client tenants. When an attacker gains control of a core administrative credential within such an ecosystem, the traditional security boundaries separating independent corporate networks quickly evaporate.
This latest campaign underscores how modern adversaries are shifting away from traditional malware or direct exploit attempts against individual corporate firewalls. Instead, they are concentrating their efforts on supply chain vectors, abusing legitimate identity infrastructure and OAuth permissions to bypass security perimeters quietly and efficiently.
Anatomy of the Incident: How the Access Was Exploded
To understand the magnitude of the exposure, one must examine how cloud backup platforms interact with Microsoft 365. Services like ConnectWise Cloud Backup require extensive API permissions to read, mirror, and restore sensitive organizational data—including emails, SharePoint documents, OneDrive repositories, and Teams chat histories. These applications often utilize service principals, delegated administrative privileges, or global administrative credentials to execute automated routines without interactive user prompts.
According to security analysts investigating the breach, the threat actors acquired legitimate credentials linked to ConnectWise's integration infrastructure. Rather than exploiting a zero-day vulnerability in the underlying software code, the attackers leveraged these authenticated credentials to log in directly through normal Microsoft 365 authentication flows.
Because the compromised identity was tied to a trusted backup and management suite, its activity appeared largely benign to standard security monitoring tools. The attackers were able to move laterally from the initial point of access into 173 separate client tenants. Once inside, the threat actors possessed the ability to inspect directory structures, exfiltrate sensitive cloud-stored documents, and map out the internal infrastructure of the target organizations.
Initial findings suggest that the intruders operated with a high degree of operational security, attempting to avoid triggering automated anomalous login alerts by abusing known, trusted API pathways. The exact method by which the primary ConnectWise credential was originally exfiltrated—whether through phishing, credential stuffing, or secondary infrastructure compromise—remains a subject of ongoing digital forensics investigations.
The MSP Ecosystem as a Primary Vector for Cyber Espionage
This intrusion is far from an isolated event; rather, it represents the continuation of a well-documented trend targeting IT administration platforms. Over the past decade, managed service providers have become top-tier targets for state-sponsored threat groups and financially motivated ransomware operators alike. The logic behind these attacks is straightforward: compromising a single enterprise software vendor yields access to hundreds or thousands of secondary targets, maximizing the return on investment for the attacker.
Platforms designed for multi-tenant management inherently concentrate risk. Tools responsible for remote monitoring and management (RMM), cloud backup, and professional services automation (PSA) hold the keys to client environments. When an adversary penetrates these centralized nodes, they inherit the administrative trust extended by the client to the vendor.
In this instance, the target software—ConnectWise Cloud Backup—is a cornerstone tool for MSPs seeking to ensure business continuity for their clients. Because backup utilities require deep access to internal data structures to create reliable snapshots, a breach at this layer grants attackers visibility into an organization’s most sensitive information assets, including proprietary intellectual property, strategic communications, and personally identifiable information (PII).
Furthermore, detecting malicious behavior within a legitimate backup application presents a profound challenge for defensive teams. Standard behavioral baselines expect backup solutions to read large volumes of data, connect to varied network endpoints, and operate during non-standard business hours. Consequently, malicious exfiltration conducted under the guise of routine backup routines often blends seamlessly into the background noise of daily enterprise IT operations.
Implications for Identity and Access Management in Cloud Environments
The incident serves as a stark reminder of the limitations of perimeter-based defense in a cloud-native world. In traditional architecture, security teams focused on securing physical networks and endpoints. In a cloud ecosystem dominated by Microsoft 365, Entra ID (formerly Azure AD), and third-party SaaS integrations, identity is the primary security perimeter.
When third-party applications are granted broad permissions to interact with Microsoft 365 environments, they often receive long-lived tokens or permanent service principal rights. If those credentials are not strictly scoped, routinely rotated, and continually monitored, they become permanent backdoors waiting to be exploited.
Several key identity security failures are highlighted by this campaign:
- Over-privileged Application Permissions: Integrations frequently request sweeping permissions—such as full read/write access to all mailboxes or site collections—when more granular, least-privilege permissions would suffice for basic functionality.
- Inadequate Service Principal Monitoring: While human user accounts are increasingly protected by multi-factor authentication (MFA) and conditional access policies, non-human identities, service accounts, and API integrations are frequently exempted from these protections or subject to less rigorous auditing.
- Blind Spots in Cross-Tenant Trust Relationships: Client organizations often lack visibility into how vendor credentials are stored, managed, and authenticated at the partner level, leaving them blind to risk originating outside their immediate administrative domain.
Remediation and Mitigation Strategies for Affected Organizations
In the wake of this campaign, security experts are urging organizations utilizing ConnectWise Cloud Backup or similar third-party administrative integrations to take immediate defensive actions. Remediating identity-based supply chain breaches requires a comprehensive review of existing cloud permissions and enterprise authentication logs.
First, organizations must audit all active enterprise applications and service principals within their Entra ID infrastructure. Security administrators should identify any applications tied to ConnectWise or SkyKick services and verify whether the associated permissions align strictly with necessary operational roles. Any legacy or unused administrative consent permissions should be revoked immediately.
Second, defenders should inspect sign-in logs and non-interactive user authentication events for anomalous activities. Specific indicators of compromise (IoCs) to search for include authentication attempts originating from unfamiliar IP addresses, unexpected geographic locations, or unusual user-agent strings associated with administrative tools. Logs should be analyzed retroactively to determine whether sensitive data was accessed or exfiltrated during the window of vulnerability.
Third, credentials, API keys, and secret tokens associated with third-party backup integrations must be rotated instantly. If an integration relies on service accounts rather than modern certificate-based authentication, those accounts must be reviewed to ensure that robust conditional access policies are applied, including restrictions based on trusted source IP ranges where technically feasible.
Finally, organizations should evaluate their implementation of Granular Delegated Admin Privileges (GDAP) within the Microsoft partner ecosystem. GDAP allows MSPs to request precise, time-bound access to client tenants, significantly reducing the blast radius if an administrative partner account is compromised.
What Lies Ahead for Vendor Risk Management
As threat actors continue to refine their supply chain techniques, the technology industry faces growing pressure to rethink how cloud-to-cloud trust is established and maintained. Regulatory bodies, cybersecurity insurance providers, and enterprise buyers are increasingly demanding transparency regarding vendor security posture and software bill of materials (SBOMs).
Moving forward, enterprise organizations can no longer afford to treat SaaS tools as black-box solutions. Vendor risk management programs must evolve beyond static security questionnaires to incorporate continuous security monitoring, mandatory zero-trust identity architectures, and rigorous third-party auditing.
For managed service providers, the challenge is existential. Trust is the fundamental currency of the MSP industry. Incidents like the exploitation of ConnectWise credentials demonstrate that a single security oversight in vendor infrastructure can jeopardize hundreds of client relationships in an instant. Building resilient infrastructure requires MSPs and their software vendors to adopt aggressive defense-in-depth strategies, ensuring that even if a service credential is breached, multi-layered controls prevent unauthorized movement into customer environments.
As the investigation into this campaign develops, the broader tech community will be watching closely to see what additional technical controls, software updates, and operational guidelines emerge to protect against the continuous threat of supply chain identity abuse.
