An active, high-impact cloud supply-chain compromise has struck ConnectWise Cloud Backup (formerly SkyKick), exposing hundreds of enterprise customer and Managed Service Provider (MSP) Microsoft 365 tenants to unauthorized access, mailbox exfiltration, and cloud privilege escalation through weaponized Microsoft Graph API application tokens.

Incident Overview & Anatomy of the Compromise

ConnectWise Cloud Backup is a widely deployed cloud-to-cloud SaaS data protection platform utilized by MSPs to safeguard mission-critical tenant workloads—including Exchange Online mailboxes, SharePoint document libraries, Microsoft Teams chats, and OneDrive directories. To perform automated daily data synchronization, the service registers multi-tenant enterprise applications inside Microsoft Entra ID (formerly Azure Active Directory).

According to disclosures from ConnectWise and concurrent forensic investigations by incident response firms, threat actors acquired valid vendor application credentials (client secrets and cryptographic signing keys) belonging to core ConnectWise Cloud Backup registration identities, including ConnectWise Cloud Management - MS Teams, Exchange Online, and SharePoint Online.

Exploitation Mechanics & Privilege Escalation Flow

Because automated backup solutions require overarching tenant privileges under Microsoft's application permission model, the compromised service principals possessed extensive application-level (app-only) permissions across consenting client tenants:

  • Mail.ReadWrite: Unrestricted programmatic access to every employee mailbox across the tenant.
  • Files.ReadWrite.All: Full read and write capabilities over all SharePoint team sites and user OneDrive storage buckets.
  • Directory.Read.All: Complete visibility into Entra ID user accounts, groups, role assignments, and directory configurations.

Adversaries utilized the compromised client secrets to request OAuth 2.0 bearer access tokens directly from Microsoft's identity platform (login.microsoftonline.com). With these tokens, threat actors executed automated Graph API queries to harvest executive email threads, download sensitive contractual documents, and enumerate corporate identity architectures:

/* Representative malicious Graph API enumeration request using compromised vendor token */
GET /v1.0/users/ceo@target-enterprise.com/mailFolders/Inbox/messages?$select=subject,sender,hasAttachments HTTP/1.1
Host: graph.microsoft.com
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6...
Accept: application/json

Persistence via Self-Assigned Application Credentials

In multiple confirmed intrusions, threat actors did not stop at data exfiltration. Adversaries abused the high-privilege directory permissions to achieve persistent secondary access by adding new, attacker-owned client credentials (certificates or client secrets) to existing, legitimate enterprise applications inside the victim's tenant, or creating entirely new rogue service principals designed to survive vendor token revocation.

Comprehensive Incident Response & Hunting Checklist

All organizations utilizing ConnectWise Cloud Backup or managing delegated Microsoft 365 environments should immediately execute the following operational playbook:

  1. Audit Entra ID Application Sign-in Logs: Search for sign-in events associated with ConnectWise application IDs originating from unexpected IP addresses or atypical autonomous system numbers (ASNs): 
    # Query Microsoft Graph PowerShell for recent service principal audit records
Get-MgAuditLogSignIn -Filter "appDisplayName eq 'ConnectWise Cloud Management - MS Teams'" -Top 100
  2. Inspect Service Principal Key Credentials: Verify whether unexpected new certificates or passwords were added to service principals in the past 30 days: 
    # Audit registered credentials across tenant applications
Get-MgApplication | ForEach-Object {
    $app = $_
    $app.PasswordCredentials | Where-Object { $_.StartDateTime -gt (Get-Date).AddDays(-30) } | ForEach-Object {
        [PSCustomObject]@{
            AppDisplayName = $app.DisplayName
            AppId          = $app.AppId
            KeyId          = $_.KeyId
            CreatedDate    = $_.StartDateTime
        }
    }
}
  3. Review and Rotate Consent Grants: Review all third-party enterprise app registrations with broad administrative scopes. Enforce conditional access policies requiring managed devices and compliant locations for all service principal activity.