ConnectWise has shut down customer access to its Cloud Backup service, formerly SkyKick, after attackers gained access to application identities and compromised Microsoft 365 tenants. Huntress identified at least 162 compromised tenants in its own environment, and Microsoft confirmed unauthorised authentication attempts starting on 15 October. The attackers signed in directly as the backup application, using permissions customers had already granted, so multi-factor authentication did not stop them. ConnectWise says it has seen no sign so far that partner backup data itself was compromised.

What it means: The incident highlights a risk that many companies underestimate: third-party apps that were given broad rights in Microsoft 365 and then forgotten. A backup tool needs access to mail, files and Teams to do its job. If the app's own credentials are stolen, the attacker inherits all of that access without needing any user's password or MFA prompt. For Greek small and medium businesses that rely on an outside IT partner, this is worrying, because they often do not know which apps the partner has installed in their tenant. The immediate practical step is an inventory of enterprise applications and service principals in Entra ID, removing anything unused and cutting permissions to the minimum required. Alerts when an app is granted administrator roles are also worth switching on. For organisations covered by the NIS2 directive, supply chain incidents of this kind are exactly the type of risk that supplier management must address. Finally, the case is a reminder that having backups is not enough if the backup tool itself becomes the way in.

Read the original on BleepingComputer

Related service: Custom software

Related stories