Hackers Exploit Compromised ConnectWise Cloud Backup Credential to Access 173 Microsoft 365 Tenants
What Happened — Researchers identified an active campaign where threat actors leveraged a stolen Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick). Using that credential, they signed into 173 customer Microsoft 365 tenants, gaining the same level of access as the legitimate service account.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of third‑party credential exposure – a scenario continuous control‑assurance programs are built to detect, log, and remediate.
- Highlights the need for real‑time monitoring of privileged access and enforceable MFA for service accounts that bridge vendors and customers.
- Shows that without robust vendor‑oversight evidence, organizations may struggle to provide a defensible audit trail after a supply‑chain breach.
Who Is Affected – Managed Service Providers (MSPs) using ConnectWise Cloud Backup and their downstream customers across all verticals (healthcare, finance, retail, etc.).
Recommended Actions
- Review and rotate any service‑account credentials shared with third‑party backup providers.
- Enforce MFA and conditional‑access policies for all privileged accounts, especially those used by vendors.
- Deploy continuous monitoring of sign‑in anomalies (impossible travel, impossible‑device) and integrate logs into a centralized Trust Center for audit readiness.
Source: The Hacker News
Technical Notes – The attackers used a stolen credential (likely obtained via phishing or credential‑dumping) to authenticate directly to Microsoft 365 via the standard OAuth flow. No specific vulnerability (CVE) was disclosed; the vector is credential compromise. Data accessed or exfiltrated has not been publicly confirmed.
Source: The Hacker News