Compromised ConnectWise Cloud Backup Credential Accessed 173 M365 Tenants via App Permissions

Huntress telemetry recorded the credential authenticating to the ConnectWise Cloud Backup application, inheriting consented permissions for full mailbox, OneDrive, SharePoint, Teams, and directory access in every tenant where the app remained enabled. The actor iterated through tenant GUIDs in sorted order, issuing tokens at intervals of seconds, consistent with automated tooling rather than manual browsing. Todyl independently confirmed identical Graph authentication patterns in its customer base and noted that issued tokens remain valid for up to 90 minutes even after app disablement.

The incident follows a prior password-spray campaign from the same IP against four law-firm tenants on 13-14 October. In one observed tenant the actor escalated by assigning Global Administrator rights to a separate ConnectWise Teams app (ID 24205314-2b89-4e07-a2a4-579e898a5640) and injecting client secrets into both an MSP management app and Huntress’s own platform. These additions create transitive paths into downstream customer tenants that inherit the MSP tooling consents.

ConnectWise has revoked the credential and suspended Cloud Backup access, stating no backup data exfiltration was detected. However, the architecture—vendor app holding persistent, high-privilege consent across MSP customer estates—remains a systemic concentration risk. MSPs that have not yet rotated secrets or revoked app consents continue to expose every downstream tenant until the next token refresh cycle completes.

Organizations should audit all vendor application consents in Entra ID, revoke sessions, and monitor for new client secrets added to privileged service principals. ConnectWise customers must verify that the Cloud Backup app is disabled and that no secondary credentials persist in their directories.