ConnectWise pulls Cloud Backup after 173 M365 tenants hit

Attackers didn’t need to phish a hundred companies this time. They got hold of one Microsoft 365 credential linked to ConnectWise Cloud Backup and used it to walk into 173 Microsoft 365 tenants.

ConnectWise says it responded by suspending Cloud Backup and disabling seven application identities while it investigates. The service—formerly SkyKick—caters to managed service providers (MSPs), so one compromised app identity can fan out across many customers at once.

What happened

Cybersecurity researchers reported an active campaign in which unknown actors abused a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup to gain access to customers’ M365 environments, affecting 173 tenants overall, according to The Hacker News.

ConnectWise said it disabled seven ConnectWise application identities after learning attackers had obtained unauthorized access to those identities and used them to compromise Microsoft 365 tenants, per a second Hacker News report. One disabled identity was listed by GUID, indicating a surgical approach to cutting off known access paths.

The company also suspended the Cloud Backup service as a containment step while the investigation continues, according to the same reporting. That move limits further exposure from any residual tokens or permissions tied to the app identities.

The reports do not attribute the activity to a specific group or region. They characterize the threat actors as unknown and the campaign as ongoing at the time of publication.

The incident centers on application identities in Microsoft Entra ID (formerly Azure AD) that can be granted tenant-wide permissions. When those identities are compromised, attackers can access data—mail, files, calendars—without needing a user’s interactive login.

Because ConnectWise Cloud Backup is designed for MSPs, a single app identity may be present in many customer tenants. That makes any compromise of its credentials a potential force multiplier compared to a single-tenant integration.

The reporting does not describe the exact permissions those identities held. Backup tools often need broad read access to Microsoft 365 data, which can include Exchange Online mailboxes—prime targets during an intrusion.

The background

ConnectWise Cloud Backup, formerly known as SkyKick, provides cloud-based backup and recovery services for Microsoft 365, built for MSPs that manage multiple customer tenants. That multi-tenant design is convenient for provisioning—and risky when an app identity is abused.

Application identities in Microsoft 365 authenticate with secrets or certificates and operate via Microsoft Graph and service-specific APIs. They can read or write data across many mailboxes or sites if granted organization-level application permissions.

When a third-party app is deployed to many tenants, each tenant typically holds a separate service principal. Compromising a central credential or abused trust relationship can expose many of those instances, especially if the same secrets or operational patterns are reused.

MSPs commonly centralize operations across dozens or hundreds of customer tenants. The upside is efficiency; the downside is blast radius if a central tool’s identity is misused. The 173-tenant figure in this case underscores that systemic risk.

This isn’t the first time attackers have leaned on cloud-integrated tools to reach inboxes. We’ve reported how a coalition went after the cloud accounts powering large-scale phishing and malware campaigns by targeting their misuse of legitimate services—see our explainer on how phishing services abuse cloud tools. The connective tissue is the same: trust in cloud identities becomes an attack surface.

Email security teams have also faced multi-layered threats that go beyond passwords, from man‑in‑the‑middle kits that steal web session tokens to tricks that aim at AI helpers in the inbox. For context on MFA bypasses, see our report on the AitM phishing kit that steals Google MFA. Different vector, same goal: durable access to cloud mail.

If you’re catching up on broader security stories and how to harden in phases, our practical guide to locking down email in 30 days walks through checks that complement app-permission reviews.

If you need a broader view of cloud and email security coverage, our Security category hub bundles related guidance, incidents, and follow-ons.

What people are saying

Researchers told The Hacker News they observed active abuse of a compromised ConnectWise Cloud Backup Microsoft 365 credential to sign into 173 tenants, indicating a coordinated campaign rather than isolated incidents (report).

ConnectWise, for its part, acknowledged unauthorized access to several application identities and said it acted to block them. The company “disabled seven ConnectWise application identities” during its investigation, and it suspended Cloud Backup while forensic work proceeds (report).

The vendor also published identifiers for the disabled identities, including at least one GUID, to help customers and partners recognize and root out lingering trust links, per the same report. That transparency helps admins target what to revoke first.

No public claims of stolen data or ransom notes were reported in the sources, and there’s no vendor attribution of the threat actors at this stage. The focus remains on containment and tenant-by-tenant clean-up.

Managed service providers watching the case say the incident highlights the need for clear inventories of which app identities have tenant-wide permissions, especially for backup, migration, and monitoring tools—functions that often require organization-level scope.

Security teams note that standard mailbox login monitoring can miss app-only access. Admins typically need to inspect sign-ins by application ID, consent events, and Microsoft Graph activity patterns to spot abuse that avoids user interactive prompts.

What happens next

ConnectWise is investigating the unauthorized access and has taken Cloud Backup offline during that process, according to the reporting. Customers should watch for vendor advisories that detail restoration steps, updated app IDs, and any required re-consent.

Microsoft 365 administrators in affected tenants will likely need to revoke existing service principal consents for the listed identities and rotate credentials where integrations persist. Expect guidance clarifying which app registrations are safe to re-enable.

Given the multi-tenant nature of MSP tooling, partners may need to repeat these checks across all managed tenants—verifying that disabled identities no longer appear, and that no shadow or duplicate app consents remain.

We’ll update when ConnectWise provides a timeline for restoring Cloud Backup and any post-incident hardening—such as new secrets, conditional access for app-only flows, or narrower Graph scopes—becomes public.