ConnectWise Breach Exposes MSP Security Responsibilities

ConnectWise has restored its Cloud Backup service following a supply-chain attack that disrupted operations for more than 2,300 managed service provider (MSP) partners and exposed security risks across downstream Microsoft 365 environments.

The incident, attributed to the China-aligned threat group Storm-0940, involved compromised application credentials that attackers used to access customer tenants. While ConnectWise has implemented additional security controls, the breach raises a critical question for MSPs: “What responsibility do providers have for verifying customer security after a trusted vendor is compromised?”

For MSPs, the answer extends beyond restoring backups to auditing application permissions, investigating unauthorized changes, and ensuring attackers have not established persistent access.

How attackers exploited ConnectWise application credentials

The intrusion did not rely on stolen passwords, phishing emails, or flawed user authentication. Instead, adversaries gained access to internal application credentials belonging to ConnectWise Cloud Backup—a service formerly known as SkyKick, which ConnectWise acquired in 2024.

Because backup utilities require visibility into replicated emails, shared files, and collaboration channels, client organizations had previously granted the multi-tenant application extensive privileges within Microsoft Entra ID. Those rights included high-level permissions such as Directory.ReadWrite.All, Microsoft Threat Intelligence reported.

Armed with the compromised application identity, the threat actors began authenticating directly against downstream Microsoft 365 tenants as a service principal. According to cybersecurity firm Huntress, attackers executed scripted authentication sweeps starting October 15, hopping from tenant to tenant in mere seconds from external IP infrastructure, including 144.172.64[.]128.

Huntress identified suspicious sign-in activity across nearly 1,000 Microsoft Entra accounts, with more than 300 successful intrusions. Because the service principal authenticated without a human user, traditional security layers, such as multi-factor authentication (MFA) and standard Conditional Access policies, were bypassed entirely.

In at least one partner tenant, the attackers leveraged a related ConnectWise management application to elevate privileges to the Global Administrator role. From there, the intruders injected rogue client secrets into other trusted tools, including an MSP management platform and Huntress’s own security application. Those rogue backdoors were configured with expiration dates extending to 2028, ensuring access would survive even if the primary backup tool were turned off.

ConnectWise moved to contain the damage on October 17 by revoking connection certificates, invalidating shared credentials, and disabling seven application identities. The company also took SaaS Security and Cloud Management offline as a precaution.

Cloud Backup restoration leaves tenant security questions

Restoring the service required a complex, multi-stage overhaul of the acquired SkyKick infrastructure—which spans more than 4,000 Microsoft Azure services—managed by ConnectWise. The vendor engaged independent third-party incident response firms to lead forensic reviews and validate clean environments.

A central hurdle in the restoration was administrative re-registration. ConnectWise worked with Microsoft to retire legacy SkyKick app registrations and stand up a newly hardened enterprise identity, “ConnectWise Cloud Backup for M365.”

To bring partners back safely without overwhelming their help desks, ConnectWise staggered the return of features. The company re-established core backup and restore capabilities first, followed by management portals and API connections. Monitoring alerts, which track missed backups, were intentionally held back in the early stages to avoid bombarding technicians with hundreds of thousands of false alarms that accumulate during downtime.

Throughout the outage, ConnectWise emphasized that its stored backup archives remained isolated, encrypted, and uncompromised. Yet the vendor candidly acknowledged that its architectural design does not give it visibility into downstream partner environments. As a result, ConnectWise could not tell individual MSPs whether their specific client tenants were accessed or altered during the intrusion window.

Agentic RMM raises broader questions about automation risk

Just as the company brought its backup service back online, ConnectWise formally launched four automated operations tools: its market-first ConnectWise Agentic RMM, alongside specialized Voice, Teams, and Email agents.

The software tools are designed to automate intake and triage. The Voice, Teams, and Email agents interact directly with end users to capture ticket details before a technician steps in. Meanwhile, the Agentic RMM tool investigates the endpoint behind a ticket, performs read-only diagnostics, tests hypotheses, and stages remediation fixes for a technician to approve directly within the PSA ticket interface.

The launch reflects an industry racing toward automation to solve labor constraints. Yet the juxtaposition of that launch with the Cloud Backup downtime illustrates a central operational tension for modern MSPs: the very connectivity and delegated machine-speed authority that make cloud platforms efficient also make them potent targets for supply-chain adversaries.

Raissipour noted that modern cyber threats are increasingly powered by automation and agentic toolsets that execute intrusions in fractions of a second, rendering human log reviews obsolete.

“AI-powered cyberattacks operate at a speed the likes of which you’ve never seen before,” Raissipour said. “What used to be telemetry data you could pick up over a period of hours from ITDR [Identity Threat Detection and Response] services or any sort of SIEM that is analyzing all logs from applications, this is now happening in microbursts of seconds. So a lot of things that you rely on to make decisions are simply too slow these days. Humans reviewing logs to determine whether something was wrong cannot keep up with AI and the pace at which they attack you.”

Why shared application permissions increase MSP exposure

The root issue exposed by the Cloud Backup disruption extends far beyond a single compromised secret. It exposes a structural vulnerability common across the software-as-a-service (SaaS) ecosystem: reliance on shared, multi-tenant enterprise applications.

When a cloud provider connects to thousands of client tenants using a single application registration, that single identity becomes an all-access pass. If the application’s underlying credentials are compromised at the vendor level, every single customer environment that granted consent is exposed simultaneously. The blast radius is immediate and widespread.

Several channel leaders believe the incident will accelerate an architectural shift toward dedicated per-tenant or per-MSP enterprise application registrations. While assigning unique cryptographic identities to every client requires significantly higher management overhead and more complex deployment pipelines, it confines future vendor compromises to isolated boundaries rather than exposing the entire customer base.

The attack also demonstrates the severe limitations of human-centric defenses. For years, service providers have treated identity security as synonymous with securing employees—enforcing phishing-resistant MFA, rotating passwords, and restricting user sign-in locations. None of those tools apply here. Service principals operate without human logins, without MFA prompts, and frequently without geographic restrictions. 

Unless service providers establish dedicated ITDR systems capable of monitoring application behavior, programmatic attacks operating through approved channels will continue to go unnoticed.

What MSPs should audit after the ConnectWise attack

For managed service providers, this incident dismantles the comfortable assumption that SaaS backup is an outsourced, set-and-forget safeguard. The vendor maintains the core platform, encrypts the remote vault, and issues software patches, but the MSP alone owns tenant security posture, delegated permissions, and customer communication.

Kasper Lindgaard, vice president of security strategy at CoreView, in an email to Channel Insider in October, pointed out that stopping the vendor-level attack is only the first step:

“If there are any indicators of a successful sign-in from the threat actor, the incident should be treated as a configuration-change incident. This means clearly mapping and reverting any non-confirmable changes performed between 1 October and 07:00 UTC on 17 October.”

He added: “ConnectWise has stopped the attack. But businesses unfortunately have the responsibility and difficult task to ensure that the threat actor didn’t change any Microsoft 365 configuration or establish any persistence within their tenant. More than a third of IT leaders wrongly believe that Microsoft automatically backs up their configuration, making recovery from such an attack all the more tricky.”

Because Microsoft Entra ID’s native backup and recovery capabilities offer only a 7-day retention window, MSPs must treat application auditing and configuration tracking as a core operational discipline rather than an annual checklist.

To properly isolate risk, service providers must execute four non-negotiable practices across their client portfolios:

• Audit service principal sign-ins separately: Interactive user logs show only half the picture. MSPs must actively ingest and monitor Entra ID service principal logs. Because legitimate vendor apps frequently change hosting networks, teams must prioritize alerting on anomalous actions, such as an app adding credentials or assigning itself privileged directory roles, over bare IP alerts.
• Enforce strict least privilege on integrated apps: Technicians frequently grant broad standing consent (such as tenant-wide read/write scopes) to simplify software deployment. Third-party applications should be audited quarterly, and any dormant applications or legacy integrations left behind from previous toolsets must be fully revoked.
• Establish configuration backups alongside data backups: Backing up mailboxes, OneDrive folders, and SharePoint documents protects user data, but it does not protect the environment itself. MSPs must maintain automated backups of Microsoft 365 tenant configurations, conditional access policies, and role assignments to quickly identify and roll back unauthorized persistence mechanisms.
• De-couple incident ownership from vendor public relations: Providers cannot wait for a software vendor to finish an investigation before talking to clients. MSPs need internal frameworks that assign technical leads to preserve evidence while account managers provide transparent, regular updates to client leadership regarding what is confirmed, what remains unverified, and what continuity steps are in place.

The impact on end users and small businesses

While software vendors and managed service providers spent days evaluating log files and re-authenticating services, the downstream impact landed squarely on end-user organizations. 

Had a routine disaster occurred during that window—such as an employee accidentally deleting a business-critical database or a ransomware payload encrypting a file server- those companies would have found their primary safety net frozen.

Beyond the immediate protection gap, end-user organizations face a subtle, lingering risk: secondary exploitation. The permissions abused by the attackers granted programmatic access to Microsoft Graph endpoints, including email, executive schedules, internal Teams discussions, and confidential customer documents stored in SharePoint.

While investigators have found no conclusive evidence that bulk data was exfiltrated from the affected tenants, the simple possibility of unauthorized access creates downstream exposure. Adversaries targeting corporate communications often harvest financial records, vendor contracts, and email threads to craft highly believable, targeted spear-phishing campaigns weeks or months after an initial intrusion.

Ultimately, the ConnectWise incident demonstrates that software supply chains are only as strong as the permissions granted to their quietest background processes. As IT operations embrace faster, automated workflows, MSPs must remember that automation without rigorous identity boundaries simply gives attackers a faster way in.