One API Secret, Hundreds of Breaches: Inside the ConnectWise Cloud Backup Supply-Chain Attack
Executive Summary
In October 2024, an unidentified threat actor exploited a compromised multi-tenant API secret tied to ConnectWise Cloud Backup (formerly SkyKick), gaining unauthorized access to Microsoft 365 environments across hundreds of customer tenants. The attacker leveraged the stolen credential to bypass MFA, perform Microsoft Graph API reconnaissance, elevate privileges, and implant persistent backdoor credentials in affected tenants. Huntress confirmed successful sign-ins across more than 300 Entra tenants, with 162 verified compromises. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services roughly two days after initial attack activity was observed on October 15, 2024.
This incident exemplifies the systemic risk of shared multi-tenant application secrets in managed service provider ecosystems. A single compromised credential cascaded into hundreds of downstream customer breaches, underscoring how supply-chain trust relationships and privileged API access can become force-multipliers for attackers targeting SMB-focused MSP platforms.
Why This Matters Now
MSP-targeting supply-chain attacks are accelerating in 2024–2025, with threat actors increasingly harvesting multi-tenant application credentials to achieve silent, MFA-bypassing access at scale. Regulatory frameworks including NIST CSF 2.0 and CISA's Secure by Design guidance now explicitly address third-party credential risk, making this class of breach a board-level compliance and vendor-risk priority.
Attack Path Analysis
An unidentified threat actor obtained a highly privileged multi-tenant API secret associated with ConnectWise Cloud Backup, enabling them to silently authenticate into nearly 1,000 Microsoft Entra tenants without requiring MFA. From there, the attacker escalated privileges within compromised tenants, performed Microsoft Graph API reconnaissance, established persistent backdoor credentials on service principals, and gained the technical ability to read and write mail, files, and data across Microsoft 365 workloads — ultimately disrupting ConnectWise's Cloud Backup, SaaS Security, and Cloud Management services for hundreds of customers.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
The threat actor obtained the ConnectWise Cloud Backup multi-tenant application API secret — a highly privileged credential that, when held, allows requesting OAuth access tokens for any tenant where the application is installed. The exact method of credential theft is unconfirmed, but the credential granted silent, MFA-bypassing access across all subscriber tenants. This is consistent with supply-chain compromise of a shared secrets store or insider/developer environment exposure.
MITRE ATT&CK® Techniques
Valid Accounts: Cloud Accounts
Steal Application Access Token
Use Alternate Authentication Material: Application Access Token
Account Manipulation: Additional Cloud Credentials
Account Discovery: Cloud Account
Data from Cloud Storage
Supply Chain Compromise: Compromise Software Supply Chain
Impair Defenses: Disable or Modify Tools
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NYDFS 23 NYCRR 500 – Access Privileges and Management
Control ID: 500.7
PCI DSS 4.0 – System and Application Accounts Management
Control ID: Requirement 8.6
DORA (Digital Operational Resilience Act) – Protection and Prevention of ICT Risks
Control ID: Article 9 — ICT Security
CISA Zero Trust Maturity Model 2.0 – Least Privilege and Continuous Validation of Identities
Control ID: Identity Pillar — Credential Management
NIS2 Directive – Supply Chain Security and Incident Response
Control ID: Article 21 — Cybersecurity Risk Management Measures
ISO/IEC 27001:2022 – Management and Control of Privileged Access
Control ID: Annex A 8.2 — Privileged Access Rights
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
ConnectWise's compromised API secret enabled supply-chain attackers to bypass MFA across ~1,000 Entra tenants, exposing IT managed service providers to lateral movement, privilege escalation, and Microsoft 365 data exfiltration risks.
Computer/Network Security
Security vendors relying on multi-tenant cloud backup integrations face critical trust-chain failures; compromised application identities allow attackers to add backdoor credentials, evading Zero Trust segmentation and egress policy enforcement controls.
Financial Services
Small-to-mid-sized financial firms using ConnectWise Cloud Backup risk unauthorized Exchange Online and SharePoint access, threatening PCI 4.0 and NIST.800-53 compliance through undetected credential-based exfiltration of sensitive client data.
Health Care / Life Sciences
Healthcare organizations using ConnectWise-managed Microsoft 365 environments face HIPAA.164.312(e)(1) violations as compromised API secrets grant read/write mail access, enabling patient data exfiltration without triggering standard authentication alerts.
Sources
- ConnectWise customers hit by supply-chain attack linked to compromised API secrethttps://cyberscoop.com/connectwise-cloud-backup-supply-chain-attack/Verified
- ConnectWise Cloud Backup Security Advisoryhttps://www.connectwise.com/company/trust/security-bulletins/connectwise-cloud-backupVerified
- Huntress Analysis: ConnectWise Cloud Backup Compromisehttps://www.huntress.com/blog/connectwise-cloud-backup-compromiseVerified
- Todyl Investigation: ConnectWise SkyKick Cloud Backup Supply Chain Incidenthttps://www.todyl.com/blog/connectwise-skykick-cloud-backup-supply-chain-attackVerified
- Microsoft Threat Intelligence LinkedIn Post on ConnectWise Cloud Backup Malicious Sign-inshttps://www.linkedin.com/posts/microsoft-security_threat-intelligence-update-connectwise-activity-7253060002713088000-XXXX
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
This incident demonstrates how a single compromised multi-tenant API secret cascaded into unauthorized access across nearly 1,000 Entra tenants, making Aviatrix Zero Trust CNSF directly relevant through its ability to enforce identity-aware segmentation and controlled egress paths. By constraining lateral reachability and limiting outbound API call surfaces, CNSF would likely reduce the blast radius an attacker could achieve even after obtaining a valid cloud credential.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF network fabric policies could likely constrain the reachability of credential stores and developer environments by enforcing segmented, identity-scoped access boundaries, reducing the network paths through which an attacker may move laterally to harvest shared secrets at scale.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation policies could likely reduce the scope of privilege escalation by constraining which workloads and service identities are permitted to issue elevated API calls, limiting the reachability of high-privilege Graph permission scopes to only explicitly authorized, identity-verified workload paths.
Control: East-West Traffic Security
Mitigation: East-west traffic security controls would likely constrain automated cross-tenant pivoting by enforcing segmented, policy-driven boundaries between workloads and cloud management planes, reducing the ability of a single compromised credential to traverse across multiple tenant environments without restriction.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and control capabilities would likely surface anomalous outbound API call patterns and unauthorized endpoint destinations, reducing the window during which attacker-controlled tooling could operate undetected across cloud management planes while masquerading as legitimate traffic.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security and policy enforcement would likely constrain unauthorized bulk data transfer paths by limiting which workloads and service identities are permitted to reach Microsoft 365 data endpoints at scale, reducing the volume and scope of data that could be exfiltrated through elevated Graph API access.
Had earlier CNSF segmentation and egress controls been in place, the residual impact would likely have been constrained to a smaller subset of tenants, reducing the remediation burden and limiting the number of service principals requiring per-tenant credential rotation and forensic review.
Impact at a Glance
Affected Business Functions
- Microsoft 365 Cloud Backup and Recovery Services
- Email and Collaboration Platforms (Exchange Online, Microsoft Teams, SharePoint Online)
- Managed Service Provider (MSP) Partner and Customer Tenant Administration
- Identity and Access Management (Microsoft Entra / Azure AD)
Estimated downtime: 5 days
Estimated loss: N/A
Attackers with the compromised API secret could read and write mail, files, and calendar data across all Microsoft 365 tenants where ConnectWise Cloud Backup was installed. Confirmed unauthorized sign-ins occurred across at least 162 Microsoft Entra tenants, with nearly 1,000 tenants exposed to sign-in attempts. Data categories at risk include business emails (Exchange Online), internal communications (Microsoft Teams), documents and files (SharePoint Online), and identity credentials and service principal configurations. Attackers also demonstrated the ability to elevate privileges and add backdoor credentials to service principals, enabling persistent unauthorized access beyond the initial compromise window. Given the multi-tenant nature of the application, the blast radius extends to all SMB customers of affected ConnectWise MSP partners who had Cloud Backup installed in their Microsoft 365 environments.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Zero Trust Segmentation (ZTMM.Network, NIST.800-53.AC-6) to enforce least-privilege identity-based policies on multi-tenant application service principals — ensuring that even if an API secret is compromised, token issuance and Graph API access is constrained to only the minimum required scopes and cannot pivot across all subscriber tenants unchecked.
- • Deploy Multicloud Visibility & Control (ZTMM.CrossCutting.Visibility, NIST.800-53.AU-6) to baseline normal OAuth token issuance and Microsoft Graph API call patterns, enabling anomaly detection when automated tooling generates sign-in spikes across hundreds of Entra tenants from a single IP within a short window — triggering alerts before lateral movement completes.
- • Enforce Egress Security & Policy Enforcement (ZTMM.Data, NIST.800-53.SC-18) with FQDN-level filtering and outbound traffic controls to detect and block unauthorized data reads from Exchange Online, SharePoint, and Teams at the network layer, preventing bulk mail and file exfiltration even when application-layer credentials are valid.
- • Leverage East-West Traffic Security (ZTMM.Network, NIST.800-53.SC-7) controls to monitor and restrict workload-to-workload and service-to-service API flows within cloud environments — particularly cross-tenant API pivoting patterns — so that lateral movement across SaaS tenants using shared application identities is detected and interrupted before widespread tenant compromise occurs.
- • Implement Cloud Native Security Fabric (CNSF) inline enforcement with real-time inspection of control plane activity (ZTMM.CrossCutting.Automation, NIST.800-53.SI-4) to identify and block attempts to add backdoor credentials to service principals and elevate application privileges, ensuring that post-compromise persistence mechanisms are prevented even when initial access via a stolen API secret succeeds.
